Vulnerability Note VU#628411

OpenConnect Webconnect read-only directory traversal vulnerability in jretest.html

Overview

OpenConnect Webconnect contains a read-only directory traversal vulnerability in the file jretest.html.

I. Description

OpenConnect Webconnect provides secured web access and emulation services for backend mainframes and UNIX servers. Versions of Webconnect prior to 6.4.5 and 6.5.1 running on all operating systems have a read-only directory traversal vulnerability. By sending a specially-crafted GET request, INI-style files outside of the web server root directory will be incorrectly parsed and have individual attribute values exposed in an error message.

Files exposed by jretest.html must be formatted in an INI-style format popularized by Microsoft Windows:

[section]

attribute1 = value1

attribute2 = value2, value3, value4

Per the OpenConnect Vendor Statement for VU#628411:

The file being accessed must be in ini-style to be parsed within WebConnect. The jretest.html page will attempt to retrieve a user configuration value from that file. When the value is found to be invalid, it is displayed within the returned error html page. This allows the end user to see the value for one key within the ini-style file. The entire file is not displayed to the user nor can the user manipulate the file in any way. This vulnerability is present in all platform versions of WebConnect but is Windows-focused due to the need for the target file to be ini-style.

II. Impact

Exploitation of this read-only directory traversal vulnerability discloses limited types of information.

III. Solution

Affected sites should upgrade to a corrected version of WebConnect, versions 6.4.5 and 6.5.1. Licensed users can send mail to OpenConnect technical support mailto: ocs_support@oc.com, or call +1-972-888-0678.

Systems Affected

Vendor	Status	Date Notified	Date Updated
OpenConnect	Vulnerable	20-Feb-2005

References

http://www.cirt.dk/advisories/cirt-29-advisory.pdf
http://www.openconnect.com/solutions/webconnect.jsp

Credit

Thanks to Dennis Rand of the Danish Computer Incident Response Team for reporting this vulnerability.

This document was written by Jeff S Havrilla and based on the OpenConnect WebConnect Development team statement, with contributions from Dennis Rand.

Other Information

Date Public:	2005-02-21
Date First Published:	2005-02-21
Date Last Updated:	2005-02-21
CERT Advisory:
CVE-ID(s):	CAN-2004-0465
NVD-ID(s):	CAN-2004-0465
US-CERT Technical Alerts:
Metric:	2.82
Document Revision:	14

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader