Elron IM Message Inspector Directory Traversal Vulnerability

Elron IM is a suite of tools providing internet filtering, virus protection, and other features.

Certain non-current versions of products in the Internet Manager suite, including IM Message Inspector, are vulnerable to directory traversal attacks.

An attacker can compose a long path including '/../' sequences, and submit it as a file request to the product's built-in webserver. The server will not filter 'dot-dot' sequences from the path, permitting the attacker to specify files outside the directory tree normally available to users.

This can permit disclosure of confidential data and sensitive system files which, if properly exploited, could lead to further compromises of the host's security.


 

Privacy Statement
Copyright 2010, SecurityFocus