|
|
>> IBM Director Directory Traversal and Multiple Information Disclosure Vulnerabilities
|
Multiple vulnerabilities have been identified in IBM Director, which could be exploited by attackers or malicious users to disclose sensitive information or cause a denial of service.
The first issue is due to an input validation error in the "cgi-bin/Redirect.bat" script that does not validate the "file" parameter, which could be exploited by remote attackers to access and read the contents of arbitrary files.
The second flaw is due to an error in the WMI CIM server that does not properly handle malformed requests, which could be exploited by attackers to cause a denial of service.
The third vulnerability is due to an error when handling malformed packets, which could be exploited by attackers to crash a vulnerable server.
The fourth issue is due to an error in the HTTP TRACE functionality, which could be exploited by attackers to gain access to information in HTTP headers (e.g. cookie and authentication data).
Affected Products
IBM Director versions prior to 5.10
Solution
Upgrade to IBM Director version 5.10 :
http://www-03.ibm.com/servers/eserver/xseries/systems_management/ibm_director/
References
http://www.vupen.com/english/advisories/2006/3532
ftp://ftp.software.ibm.com/pc/pccbbs/pc_servers_pdf/dir5.10_docs_relnotes.pdf
Credits
Vulnerabilities reported by the vendor and Daniel Clemens
ChangeLog
2006-09-08 : Initial release
Vulnerability Management
Subscribe to VUPEN VNS and receive real-time alerts when new advisories or patches relevant to your systems and network configurations are available.
Feedback
If you have additional information or corrections for this security advisory please submit them via our contact form. | |
|
