bugtraq - DDIVRT-2008-15 iPhone Configuration Web Utility 1.0 for Windows Directory Traversal

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 21 Nov 2008 17:04:58 -0000
From: vulnerabilityresearch@...frontline.com
To: bugtraq@...urityfocus.com
Subject: DDIVRT-2008-15 iPhone Configuration Web Utility 1.0 for Windows
 Directory Traversal

Title
-----
DDIVRT-DDIVRT-2008-15 iPhone Configuration Web Utility 1.0 for Windows Directory Traversal

Severity
--------
High

Date Discovered
---------------
October 2, 2008

Discovered By
-------------
Digital Defense, Inc. Vulnerability Research Team
Credit: Corey LeBleu and r@...$

Vulnerability Description
-------------------------
The iPhone Configuration Web Utility allows centralized management of iPhone configuration settings. The iPhone Configuration Web Utility 1.0 for Windows web interface is vulnerable to a common web directory traversal attack. Successful exploitation will result in arbitrary read-only file access outside of the iPhone Configuration Web Utility 1.0 web root.

Solution Description
--------------------
Filter network traffic so that only trusted users can access the web interface.

Tested Systems / Software (with versions)
------------------------------------------
Windows XP Professional
iPhone Configuration Web Utility 1.0 for Windows

Vendor Contact
--------------
Vendor Name: Apple Inc.
Vendor Website: www.apple.com