Full Disclosure mailing list archives
Re: Directory traversal in SafeNet Sentinel Protection and Key Server 7.4.1.0
From: jfvanmeter () comcast net
Date: Tue, 12 Feb 2008 15:40:39 +0000
Hello everyone, was the server rebooted after the patch was installed? I just setup a SafeNet Sentinel Protection Server SafeNet Sentinel Keys Server 7.4 and the exploit worked. Once I isntalled the patch, and rebooted, when I try to run the exploit the server repsonds with "The Page Cannot be Displayed" Take Care --John -------------- Original message ---------------------- From: Luigi Auriemma <aluigi () autistici org>
####################################################################### Luigi Auriemma Application: SafeNet Sentinel Protection Server SafeNet Sentinel Keys Server http://www.safenet-inc.com Versions: <= 7.4.1.0 (aka SPI740SecurityPatch) Platforms: Windows Bug: directory traversal Exploitation: remote Date: 10 Feb 2008 Author: Luigi Auriemma e-mail: aluigi () autistici org web: aluigi.org ####################################################################### 1) Introduction 2) Bug 3) The Code 4) Fix ####################################################################### =============== 1) Introduction =============== The Sentinel Protection and Key Server are two simple webservers for the monitoring of the licenses and listen respectively on ports 6002 and 7002. ####################################################################### ====== 2) Bug ====== Both the webservers are affected by a directory traversal vulnerability exploitable using the backslash delimiter (the servers don't support hex chars) allowing an attacker to download any file in the disk on which the services are installed. It's funny to note that the security patch available from November 2007 was released just to fix a directory traversal vulnerability but they dropped only the slash delimiter leaving the backslash working. ####################################################################### =========== 3) The Code =========== GET /..\..\..\..\..\..\..\boot.ini HTTP/1.0 ####################################################################### ====== 4) Fix ====== No fix ####################################################################### --- Luigi Auriemma http://aluigi.org
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: Directory traversal in SafeNet Sentinel Protection and Key Server 7.4.1.0 jfvanmeter (Feb 12)
- Re: Directory traversal in SafeNet Sentinel Protection and Key Server 7.4.1.0 Luigi Auriemma (Feb 12)
- <Possible follow-ups>
- Re: Directory traversal in SafeNet Sentinel Protection and Key Server 7.4.1.0 jfvanmeter (Feb 12)
- Re: Directory traversal in SafeNet Sentinel Protection and Key Server 7.4.1.0 Luigi Auriemma (Feb 12)
- Re: Directory traversal in SafeNet Sentinel Protection and Key Server 7.4.1.0 jfvanmeter (Feb 12)
- Re: Directory traversal in SafeNet Sentinel Protection and Key Server 7.4.1.0 Luigi Auriemma (Feb 12)
- Re: Directory traversal in SafeNet Sentinel Protection and Key Server 7.4.1.0 jfvanmeter (Feb 12)