safenet-traverse.txt

`  
#######################################################################  
  
Luigi Auriemma  
  
Application: SafeNet Sentinel Protection Server  
SafeNet Sentinel Keys Server  
http://www.safenet-inc.com  
Versions: <= 7.4.1.0 (aka SPI740SecurityPatch)  
Platforms: Windows  
Bug: directory traversal  
Exploitation: remote  
Date: 10 Feb 2008  
Author: Luigi Auriemma  
e-mail: [email protected]  
web: aluigi.org  
  
  
#######################################################################  
  
  
1) Introduction  
2) Bug  
3) The Code  
4) Fix  
  
  
#######################################################################  
  
===============  
1) Introduction  
===============  
  
  
The Sentinel Protection and Key Server are two simple webservers for  
the monitoring of the licenses and listen respectively on ports 6002  
and 7002.  
  
  
#######################################################################  
  
======  
2) Bug  
======  
  
  
Both the webservers are affected by a directory traversal  
vulnerability exploitable using the backslash delimiter (the servers  
don't support hex chars) allowing an attacker to download any file in  
the disk on which the services are installed.  
  
It's funny to note that the security patch available from November 2007  
was released just to fix a directory traversal vulnerability but they  
dropped only the slash delimiter leaving the backslash working.  
  
  
#######################################################################  
  
===========  
3) The Code  
===========  
  
  
GET /..\..\..\..\..\..\..\boot.ini HTTP/1.0  
  
  
#######################################################################  
  
======  
4) Fix  
======  
  
  
No fix  
  
  
#######################################################################  
  
  
---   
Luigi Auriemma  
http://aluigi.org  
`