The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
SafeNet Sentinel Protection and Key Server Directory Traversal
------------------------------------------------------------------------
SUMMARY
The <http://www.safenet-inc.com> Sentinel Protection and Key Server are
"two simple webservers for the monitoring of the licenses and listen
respectively on ports 6002 and 7002". A directory traversal vulnerability
has been discovered in both SafeNet Sentinel protection server as well as
their key server.
DETAILS
Vulnerable Systems:
* SafeNet Sentinel Protection Server version 7.4.1.0
* SafeNet Sentinel Keys Server version 7.4.1.0
Both the webservers are affected by a directory traversal vulnerability
exploitable using the backslash delimiter (the servers don't support hex
chars) allowing an attacker to download any file in the disk on which the
services are installed.
It's funny to note that the security patch available from November 2007
was released just to fix a directory traversal vulnerability but they
dropped only the slash delimiter leaving the backslash working.
Exploit:
The following packet will trigger the vulnerability:
GET /..\..\..\..\..\..\..\boot.ini HTTP/1.0
ADDITIONAL INFORMATION
The information has been provided by <mailto:aluigi@autistici.org> Luigi
Auriemma.
The original article can be found at:
<http://aluigi.altervista.org/adv/sentinella-adv.txt>
http://aluigi.altervista.org/adv/sentinella-adv.txt
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
