Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Bugtraq
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

2007-06 Sentinel Protection Server Directory Traversal

from [VulnerabilityResearch] Network Security [Permanent Link]
Subject: 2007-06 Sentinel Protection Server Directory Traversal
Date: 26 Nov 2007 12:53:01 -0000 
Title
-----
Sentinel Protection Server Directory Traversal

Severity
--------
High

Date Discovered
---------------
October 10th, 2007

Discovered By
-------------
Digital Defense, Inc. Vulnerability Research Team
Credit: Corey Lebleu

Vulnerability Description
-------------------------
A classic directory traversal condition exists within the Sentinel Protection 
Server. By sending in an HTTP GET request with a path of a file proceeded by 
and escaped traversal sequence, an attacker can leverage an arbitrary file 
access condition on the affected system.

Solution Description
--------------------
Digital Defense, Inc. initially notified SafeNet on October 12, 2007 and 
received confirmation from the notification on October 30, 2007.  SafeNet 
informed DDI that it would be releasing a patch for this flaw on November 16, 
2007.  At this time, DDI does not have a resolution number for the SafeNet 
patch for this flaw.    

Tested Systems / Software (with versions)
-----------------------------------------
Sentinel Protection Server 7.1
Other versions may be vulnerable to this flaw.

Vendor Contact
--------------
SafeNet
http://www.safenet-inc.com/
[More messages with this same subject...]




<Prev in Thread] Current Thread [Next in Thread>
  • 2007-06 Sentinel Protection Server Directory Traversal, VulnerabilityResearch <=
Previous by Date:  GWExtranet Script Injections & Privilege Escalation Vulnerability, DoZ
Next by Date:  DeluxeBB E-Mail Address Change Security Bypass, bugtraq
Previous by Thread:  GWExtranet Script Injections & Privilege Escalation Vulnerability, DoZ
Next by Thread:  DeluxeBB E-Mail Address Change Security Bypass, bugtraq
Indexes:  [Date] [Thread] [Top] [All Lists]