full-disclosure - DDIVRT-DDIVRT-2008-15 iPhone Configuration Web Utility 1.0 for Windows Directory Traversal

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2571D31D42513640AE1632FEE100E0E402DD7446@hypercom.defense.local>
Date: Fri, 21 Nov 2008 11:11:29 -0600
From: "DDI_Vulnerability_Alert" <DDI.VulnerabilityAlert@...frontline.com>
To: <full-disclosure@...ts.grok.org.uk>
Subject: DDIVRT-DDIVRT-2008-15 iPhone Configuration Web
	Utility 1.0 for Windows Directory Traversal

Title

-----

DDIVRT-DDIVRT-2008-15 iPhone Configuration Web Utility 1.0 for Windows
Directory Traversal

Severity

--------

High

Date Discovered

---------------

October 2, 2008

Discovered By

-------------

Digital Defense, Inc. Vulnerability Research Team

Credit: Corey LeBleu and r@...$

Vulnerability Description

-------------------------

The iPhone Configuration Web Utility allows centralized management of
iPhone configuration settings. The iPhone Configuration Web Utility 1.0
for Windows web interface is vulnerable to a common web directory
traversal attack. Successful exploitation will result in arbitrary
read-only file access outside of the iPhone Configuration Web Utility
1.0 web root.

Solution Description

--------------------

Filter network traffic so that only trusted users can access the web
interface.

Tested Systems / Software (with versions)

------------------------------------------

Windows XP Professional

iPhone Configuration Web Utility 1.0 for Windows

Vendor Contact

--------------

Vendor Name: Apple Inc.

Vendor Website: www.apple.com

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/