OpenConnect Webconnect contains a read-only directory traversal vulnerability in the file jretest.html.
OpenConnect Webconnect provides secured web access and emulation services for backend mainframes and UNIX servers. Versions of Webconnect prior to 6.4.5 and 6.5.1 running on all operating systems have a read-only directory traversal vulnerability. By sending a specially-crafted GET request, INI-style files outside of the web server root directory will be incorrectly parsed and have individual attribute values exposed in an error message.
Files exposed by jretest.html must be formatted in an INI-style format popularized by Microsoft Windows:
Exploitation of this read-only directory traversal vulnerability discloses limited types of information.
Affected sites should upgrade to a corrected version of WebConnect, versions 6.4.5 and 6.5.1. Licensed users can send mail to OpenConnect technical support mailto: firstname.lastname@example.org, or call +1-972-888-0678.
Thanks to Dennis Rand of the Danish Computer Incident Response Team for reporting this vulnerability.
This document was written by Jeff S Havrilla and based on the OpenConnect WebConnect Development team statement, with contributions from Dennis Rand.
|Date First Published:
|Date Last Updated:
|2005-02-21 17:18 UTC