PT-2001-1964 · Igss · Air Messenger Lan Server

Published 2001-10-12 · Updated 2008-09-05 · CVE-2001-0785

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Air Messenger LAN Server version 3.4.2

Description The issue allows remote attackers to read arbitrary files via a .. (dot dot) attack, which is a type of directory traversal attack. This attack takes advantage of the Webpaging interface in the affected software.

Recommendations For Air Messenger LAN Server version 3.4.2, consider restricting access to the Webpaging interface until a patch is available. As a temporary workaround, limit the ability to read arbitrary files by implementing strict file system permissions.

Fix

Related Identifiers

CVE-2001-0785

Affected Products

Air Messenger Lan Server

References · 3

• http://securityfocus.com/bid/2883 · Vendor Advisory
• http://archives.neohapsis.com/archives/bugtraq/2001-06/0228.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2001-0785 · Security Note