[22365] in bugtraq
[SNS Advisory No.39] WinWrapper Professional 2.0 Remote Arbitrary File Disclosure Vulnerability
daemon@ATHENA.MIT.EDU (snsadv@lac.co.jp)
Tue Aug 21 19:40:14 2001
Date: Wed, 22 Aug 2001 07:35:51 +0900
From: "snsadv@lac.co.jp" <snsadv@lac.co.jp>
To: bugtraq@securityfocus.com
Message-Id: <20010822073405.1CDB.SNSADV@lac.co.jp>
MIME-Version: 1.0
Content-Type: text/plain; charset="US-ASCII"
Content-Transfer-Encoding: 7bit
----------------------------------------------------------------------
SNS Advisory No.39
WinWrapper Professional 2.0 Remote Arbitrary File Disclosure
Vulnerability
Problem first discovered: Mon, 16 Jul 2001
Published: Mon, 20 Aug 2001
----------------------------------------------------------------------
Overview:
---------
WinWrapper Professional 2.0 is a firewall software. It provides Web-based
remote console. This console contains a vulnerability to allow
attacker to read arbitrary files.
Problem Description:
--------------------
WinWrapper Professional 2.0 is a firewall software which is developed
by ASCII NT, INC. It is designed to protect WindowsNT/2000 systems,
and provides additional Web-based capability of remote administration.
But the program which is used as remote administration server contains
a vulnerability. It is possible to read arbitrary files on the target
system with Local System context.
Ex.
http://<IP_Address_of_WinWrapper>:4096/../../../winnt/repair/sam
note:
4096 is the port number used by default.
Tested Version:
---------------
WinWrapper Professional 2.0 Ver.2.0.0
Tested OS:
----------
Windows 2000 Server + SP2 [Japanese]
Patch Information:
------------------
Fixed module (Ver.2.0.1) is available on following URL:
http://www.tsc.ant.co.jp/products/download.htm
Discovered by:
--------------
ARAI Yuu (LAC / y.arai@lac.co.jp)
Disclaimer:
-----------
All information in these advisories are subject to change without any
advanced notices neither mutual consensus, and each of them is released
as it is. LAC Co.,Ltd. is not responsible for any risks of occurrences
caused by applying those information.
References
----------
Archive of this advisory(in preparation now):
http://www.lac.co.jp/security/english/snsadv_e/39_e.html
------------------------------------------------------------------
Secure Net Service(SNS) Security Advisory <snsadv@lac.co.jp>
Computer Security Laboratory, LAC http://www.lac.co.jp/security/
