full-disclosure - [CIRT.DK - Advisory 37] TAC Vista Webstation 3.0 Directory Traversal bug in webinterface

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Fri Sep 16 20:24:27 2005
From: advisory at cirt.dk (CIRT.DK Advisory)
Subject: [CIRT.DK - Advisory 37] TAC Vista Webstation 3.0
	Directory Traversal bug in webinterface

TAC Vista is based on open technologies, TAC VistaR is one of the most
advanced software solutions for building automation. 
TAC Vista efficiently and economically controls, checks and analyzes all
building operations, allowing system operators to control and monitor entire
systems on site or from remote locations. 

The Web application is running on a Microsoft IIS 5.0 Server in this case. 

The problem is occurring in the input field of where the Template is called,
resulting in the possibility to traverse into other parts of the system.

Read the full Advisory at http://www.cirt.dk