Open Text Corporation FirstClass Malicious File Execution Vulnerability

Bugtraq ID:	9551
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 02 2004 12:00AM
Updated:	Feb 02 2004 12:00AM
Credit:	The disclosure of this issue has been credited to Richard Maudsley <[email protected]>.
Vulnerable:	Open Text Corporation FirstClass 7.1
Not Vulnerable:

Open Text Corporation FirstClass Malicious File Execution Vulnerability

It has been reported that FirstClass may be prone to a vulnerability that may allow an attacker to execute arbitrary applications on a vulnerable system. This issue may be exploited by placing special characters such as <>\/?*" at the end of the file extension. Due to improper sanitization of user-supplied file names, malicious files with specially crafted names may be executed without a warning prompt being displayed.

FirstClass version 7.1 has been reported to be prone to this issue.

Open Text Corporation FirstClass Malicious File Execution Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Open Text Corporation FirstClass Malicious File Execution Vulnerability

References:

• FirstClass Homepage (Open Text Corporation)