Search...

avm-traversal.txt

2007-01-20T00:00:00

ID PACKETSTORM:53772
Type packetstorm
Reporter H. Wiedemann
Modified 2007-01-20T00:00:00

Description

                                        
                                            `- Description  
The "AVM IGD CTRL Service", a Universal Plug and Play (UPNP) service for  
windows, which is part of the software package "Fritz!DSL Software  
02.02.29" provides the possibility to read any file on the windows  
system partition for any user - no matter how much restricted rights the  
user has.  
It is even possible to read files from any LAN computer on which this  
service is running and it is possible to read critical system files (SAM  
DB copies, profile files of any user) because the service is running  
under the (locally) most privileged system account.  
  
The mentioned software package is shipped with VOIP routers from the  
german company AVM (www.avm.de).  
  
  
- Reproduction  
Relative URLs for the AR7 webserver (which is part of the mentioned UPNP  
service) can be used to read files on the system partition. Because  
backslashes can't be directly used in a URL "%5C" has to be used.  
  
Examples for local and remote files of LAN computers:  
http://localhost:49001/..%5C..%5C..%5Cwindows%5Csystem.ini  
http://192.168.178.20:49001/..%5C..%5C..%5Cwindows%5Csystem.ini  
  
  
- Workaround  
Disable the "AVM IGD CTRL Service" under the services control panel.  
  
  
Regards,  
  
--   
  
DPR  
  
`

JSON Vulners Source

Initial Source

{"id": "PACKETSTORM:53772", "type": "packetstorm", "bulletinFamily": "exploit", "title": "avm-traversal.txt", "description": "", "published": "2007-01-20T00:00:00", "modified": "2007-01-20T00:00:00", "cvss": {"vector": "NONE", "score": 0.0}, "href": "https://packetstormsecurity.com/files/53772/avm-traversal.txt.html", "reporter": "H. Wiedemann", "references": [], "cvelist": [], "lastseen": "2016-11-03T10:18:28", "viewCount": 1, "enchantments": {"score": {"value": -0.2, "vector": "NONE", "modified": "2016-11-03T10:18:28", "rev": 2}, "dependencies": {"references": [], "modified": "2016-11-03T10:18:28", "rev": 2}, "vulnersScore": -0.2}, "sourceHref": "https://packetstormsecurity.com/files/download/53772/avm-traversal.txt", "sourceData": "`- Description \nThe \"AVM IGD CTRL Service\", a Universal Plug and Play (UPNP) service for \nwindows, which is part of the software package \"Fritz!DSL Software \n02.02.29\" provides the possibility to read any file on the windows \nsystem partition for any user - no matter how much restricted rights the \nuser has. \nIt is even possible to read files from any LAN computer on which this \nservice is running and it is possible to read critical system files (SAM \nDB copies, profile files of any user) because the service is running \nunder the (locally) most privileged system account. \n \nThe mentioned software package is shipped with VOIP routers from the \ngerman company AVM (www.avm.de). \n \n \n- Reproduction \nRelative URLs for the AR7 webserver (which is part of the mentioned UPNP \nservice) can be used to read files on the system partition. Because \nbackslashes can't be directly used in a URL \"%5C\" has to be used. \n \nExamples for local and remote files of LAN computers: \nhttp://localhost:49001/..%5C..%5C..%5Cwindows%5Csystem.ini \nhttp://192.168.178.20:49001/..%5C..%5C..%5Cwindows%5Csystem.ini \n \n \n- Workaround \nDisable the \"AVM IGD CTRL Service\" under the services control panel. \n \n \nRegards, \n \n-- \n \nDPR \n \n`\n", "immutableFields": []}