IBM Directory Server 'ldacgi' Discloses Files to Remote Users
|
|
SecurityTracker Alert ID: 1010834
|
|
SecurityTracker URL: http://securitytracker.com/id?1010834
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Aug 2 2004
|
Impact: Disclosure of system information, Disclosure of user information
|
Fix Available: Yes
Exploit Included: Yes
Vendor Confirmed: Yes
|
Version(s): 4.1 and prior versions
|
Description: A vulnerability was reported in the IBM Directory Server in 'ldacgi.exe'. A remote user can view files on the target system with the privileges of the web service.
Oliver Karow reported that the script does not properly validate user-supplied input in the 'Template' parameter. A remote user
can supply a path containing directory traversal characters ('../') to view arbitrary files on the target system.
A demonstration
exploit URL is provided:
http://myserver/ldap/cgi-bin/ldacgi.exe?Action=Substitute&Template=../../../../../boot.ini&Sub=LocalePath&LocalePath=enus1252
The
original advisory is available at:
http://www.oliverkarow.de/research/IDS_directory_traversal.txt
|
Impact: A remote user can view arbitrary files on the target system with the privileges of the web service.
|
Solution: The vendor was already aware of the vulnerability and has released a fix as part of 3.2.2 Fix Pack 4 (http://www-1.ibm.com/support/docview.wss?rs=0&uid=swg24006917)
and 4.1 Fix Pack 3.
APARs IR53631 and IR52692 provide additional information:
http://www.ibm.com/support/docview.wss?uid=swg1IR53631
http://www.ibm.com/support/doc
view.wss?uid=isg1IR52692
|
Vendor URL: www.ibm.com/support/docview.wss?uid=isg1IR52692 (Links to External Site)
|
Cause: Access control error, Input validation error
|
Underlying OS: Linux (Any), UNIX (AIX), UNIX (HP/UX), UNIX (Solaris - SunOS), Windows (2000)
|
Reported By: <oliver@greyhat.de>
|
Message History:
None.
|
Source Message Contents
|
Date: Mon, 2 Aug 2004 10:44:02 +0200
From: <oliver@greyhat.de>
Subject: [Full-Disclosure] =?iso-8859-1?Q?IBM_Directory_Server_-_ldacgi=2Eexe?=
|
hi there,
try this to read any file on IBM Directory Server <= 4.1
http://myserver/ldap/cgi-bin/ldacgi.exe?Action=Substitute&Template=../../../../../boot.ini&Su
b=LocalePath&LocalePath=enus1252
PS:
This vuln is already known to IBM and a fix is available.
But since i did not found any information about existence and
exploitation of this vuln on the web, i wrote this little mail.
For further information look here:
http://www.oliverkarow.de/research/IDS_directory_traversal.txt
/Oliver
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
|
|
