Elron IM Anti-Virus Directory Traversal Vulnerability

Elron IM is a suite of tools providing internet filtering, virus protection, and other features.

Certain non-current versions of products in the Internet Manager suite, including IM Anti-Virus, are vulnerable to directory traversal attacks.

An attacker can compose a long path which includes '/../' sequences, and submit it as a file request to the built-in webserver. The server will not filter 'dot-dot' sequences from the path, permitting the attacker to specify files outside the directory tree normally available to users.

This can permit disclosure of confidential data and sensitive system files which, if properly exploited, could lead to further compromises of the host's security.


 

Privacy Statement
Copyright 2010, SecurityFocus