[24937] in bugtraq
iXsecurity.20020316.csadmin_dir.a
daemon@ATHENA.MIT.EDU (Patrik Karlsson)
Wed Apr 3 19:29:24 2002
To: bugtraq@securityfocus.com
Cc: Hackers@guardianit.se
Message-ID: <OFE2143C45.2C78DFB8-ONC1256B90.004848AA@guardianit.se>
From: "Patrik Karlsson" <Patrik.Karlsson@ixsecurity.com>
Date: Wed, 3 Apr 2002 17:58:47 +0200
MIME-Version: 1.0
Content-type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: 8bit
iXsecurity Security Vulnerability Report
No: iXsecurity.20020316.csadmin_dir.a
========================================
Vulnerability Summary
---------------------
Problem: Cisco Secure ACS webserver has a directory
traversal
issue.
Threat: An attacker could retrieve any html, htm, class,
jpg, jpeg or gif file outside of the webroot.
Affected Software: Cisco Secure ACS 2.6.X and 3.0.1 (build 40).
Platform: Windows NT/2000.
Solution: Install the patch from Cisco.
Vulnerability Description
-------------------------
Cisco Secure ACS has a webserver interface listening on port 2002.
It is possible for a logged in user to read files outside the webdirectory.
After a succesfull login, one could supply eg.
http://<ip>:<dynamicport>/..\..\..\..\..\..\temp\temp.class to read the
contents
of the file temp.class in the folder temp on the same volume that the
software
is installed.
Solution
--------
Cisco PSIRT can confirm this vulnerability. The Security Advisory
was published and it is at
http://www.cisco.com/warp/public/707/ACS-Win-Web.shtml
Only Cisco ACS for Windows is affected. The Unix version is not
affected by these issues. You can download patches by following
instructions in the Advisory.
Additional Information
----------------------
Cisco was contacted 20020316.
This vulnerability was found and researched by
Jonas Ländin, jonas.landin@ixsecurity.com
Patrik Karlsson, patrik.karlsson@ixsecurity.com
