CA eSCC r8/1.0,eTrust Audit r8/1.5 Unspecified Arbitrary File Manipulation

2006-09-21T00:00:00
ID EDB-ID:28641
Type exploitdb
Reporter Patrick Webster
Modified 2006-09-21T00:00:00

Description

CA eSCC r8/1.0,eTrust Audit r8/1.5 Unspecified Arbitrary File Manipulation. CVE-2006-4900. Remote exploit for windows platform

                                        
                                            source: http://www.securityfocus.com/bid/20139/info
 
CA eTrust Security Command Center (eSCC) and eTrust Audit are prone to multiple vulnerabilities, including:
 
- an information-disclosure issue
- an arbitrary-file-deletion issue
- a replay issue.
 
These vulnerabilities occur because the software fails to validate user input and because of design errors in the way the software handles user permissions and secure data-transmission protocols.
 
An attacker may exploit these vulnerabilities to access sensitive information, delete arbitrary files with the permissions of the service account, and carry out external replay attacks.

https://www.example.com:8080/etrust/servlet/eSMPAuditServlet?verb=getadhochtml&eSCCAdHocHtmlFile=../../../../../../../boot.ini