PT-2008-2814 · Microworld · Escan Corporate Edition+2

Publicado 2008-03-10 · Atualizado 2018-10-11 · CVE-2008-1221

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions MicroWorld eScan Corporate Edition version 9.0.742.98 MicroWorld eScan Management Console (aka eScan Server) version 9.0.742.1

Description The issue allows remote attackers to read arbitrary files via an absolute pathname in the RETR (get) command. This is due to an absolute path traversal vulnerability in the FTP server.

Recommendations For MicroWorld eScan Corporate Edition version 9.0.742.98, update to a version that fixes this issue. For MicroWorld eScan Management Console (aka eScan Server) version 9.0.742.1, update to a version that fixes this issue. As a temporary workaround, consider restricting access to the FTP server until a patch is available.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2008-1221

Produtos afetados

Escan Corporate Edition

Escan Management Console

Escan Server

Referências · 8

• 🔥 https://exploit-db.com/exploits/31345 · Exploit
• 🔥 http://securityfocus.com/bid/28127 · Exploit
• 🔥 http://aluigi.altervista.org/adv/escaz-adv.txt · Exploit
• 🔥 http://secunia.com/advisories/29246 · Exploit
• http://securityfocus.com/archive/1/489228/100/0/threaded · Nota
• http://securityreason.com/securityalert/3723 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41033 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-1221 · Nota de Segurança