A vulnerability has been identified in IP3 NetAccess, which could be exploited by attackers to gain unauthorized access to arbitrary files on a vulnerable system. This issue is due to an input validation error in the "portalgroups/portalgroups/getfile.cgi" script that does not validate the "filename" parameter, which could be exploited by malicious users to access and disclose the contents of arbitrary files.

Affected Products

IP3 NetAccess versions prior to 4.1.9.6

Solution

Upgrade to IP3 NetAccess version 4.1.9.6 :
http://www.ip3.com/supportoverview.htm

References

http://www.vupen.com/english/advisories/2007/0615
http://www.devtarget.org/ip3-advisory-02-2007.txt

Credits

Vulnerability reported by Sebastian Wolfgarten

Changelog

2007-02-15 : Initial release

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.