full-disclosure - DDIVRT-2008-17 Orb Directory Traversal

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2571D31D42513640AE1632FEE100E0E402DD7438@hypercom.defense.local>
Date: Thu, 6 Nov 2008 13:59:22 -0600
From: "DDI_Vulnerability_Alert" <DDI.VulnerabilityAlert@...frontline.com>
To: <full-disclosure@...ts.grok.org.uk>
Subject: DDIVRT-2008-17 Orb Directory Traversal

Title

-----

DDIVRT-2008-17 Orb Directory Traversal

Severity

--------

High

Date Discovered

---------------

October, 21st 2008

Discovered By

-------------

Digital Defense, Inc. Vulnerability Research Team

Credit: Steven James and r@...$

Vulnerability Description

-------------------------

Orb Networks' Orb media server is vulnerable to directory traversal
attacks.  Users can leverage specially crafted GET requests to read
arbitrary files. 

Solution Description

--------------------

Use firewall rules to restrict access to authorized users of the Orb
server.

This issue is fixed in version 2.01.0022 available at

      http://www.orb.com/download/us/setup_2.01.0022.exe
<http://www.orb.com/download/us/setup_2.01.0022.exe>  

Tested Systems / Software (with versions)

------------------------------------------

Orb version 2.01.0017 on Windows XP Pro SP2

Nullsoft Winamp Remote Server Beta (featuring Orb version 2.01.0013) on
Windows XP Pro SP2

Vendor Contact

--------------

Orb Networks

Website: http://www.orb.com

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/