BitDefender Products - Update Server HTTP Daemon Directory Traversal



EKU-ID: 36043 CVE: CVE-2008-0396;OSVDB-40518 OSVDB-ID:
Author: Oliver Karow Published: 2008-01-19 Verified: Verified
Download:

Rating

☆☆☆☆☆
Home


source: https://www.securityfocus.com/bid/27358/info

BitDefender Update Server is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data.

Exploiting this issue allows an attacker to access potentially sensitive information that could aid in further attacks.

BitDefender Security for File Servers, BitDefender Enterprise Manger, and other BitDefender products that include the Update Server are vulnerable. This issue affects Update Server when running on Windows; Linux and UNIX variants may also be affected.

echo -e "GET /../../boot.ini HTTP/1.0\r\n\r\n" | nc <server> <port>