Full Disclosure mailing list archives
DDIVRT-DDIVRT-2008-15 iPhone Configuration Web Utility 1.0 for Windows Directory Traversal
From: "DDI_Vulnerability_Alert" <DDI.VulnerabilityAlert () ddifrontline com>
Date: Fri, 21 Nov 2008 11:11:29 -0600
Title ----- DDIVRT-DDIVRT-2008-15 iPhone Configuration Web Utility 1.0 for Windows Directory Traversal Severity -------- High Date Discovered --------------- October 2, 2008 Discovered By ------------- Digital Defense, Inc. Vulnerability Research Team Credit: Corey LeBleu and r@b13$ Vulnerability Description ------------------------- The iPhone Configuration Web Utility allows centralized management of iPhone configuration settings. The iPhone Configuration Web Utility 1.0 for Windows web interface is vulnerable to a common web directory traversal attack. Successful exploitation will result in arbitrary read-only file access outside of the iPhone Configuration Web Utility 1.0 web root. Solution Description -------------------- Filter network traffic so that only trusted users can access the web interface. Tested Systems / Software (with versions) ------------------------------------------ Windows XP Professional iPhone Configuration Web Utility 1.0 for Windows Vendor Contact -------------- Vendor Name: Apple Inc. Vendor Website: www.apple.com
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- DDIVRT-DDIVRT-2008-15 iPhone Configuration Web Utility 1.0 for Windows Directory Traversal DDI_Vulnerability_Alert (Nov 21)