bugtraq - Re: ManageEngine Firewall Analyzer arbitrary file disclosure to authorized user

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20070330070638.22219.qmail@securityfocus.com>
Date: 30 Mar 2007 07:06:38 -0000
From: support@...nalyzer.com
To: bugtraq@...urityfocus.com
Subject: Re: ManageEngine Firewall Analyzer arbitrary file disclosure to
 authorized user

We thank you for bringing this to our notice & apologize for any inconvenience this has caused.

The reason for this problem is that we were passing the absolute path of the file in the URL. This has now been fixed by providing an randomly generated Identifier which is mapped to file. This fix is made available in our upcoming build 4030. Any users who would like to get an early access to this build can feel free to send us a request mail to <support at fwanalyzer dot com>

Thanks & Regards
AJ