The Attachmate Verastream Host Integrator (VHI) is vulnerable to arbitrary file uploads and execution.
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') - CVE-2013-3626
The Attachmate VHI Session Server, on all platforms, allows unauthenticated remote attackers to write arbitrary files on the machine in which the product is installed by sending a specially crafted message to the VHI Session Server. The affected versions are:
An attacker may be able to gain complete control of the server on which the application is installed.
Apply a HotfixAttachmate has released a hotfix to address this issue while a patch is being developed. The hotfix can be found at: http://support.attachmate.com/techdocs/2700.html
Thanks to Arnold Geels of Attachmate for reporting this vulnerability.
This document was written by Chris King.
|Date First Published:||2013-11-04|
|Date Last Updated:||2013-11-19 22:40 UTC|