Sentinel Protection Server Directory Traversal
October 10th, 2007
Digital Defense, Inc. Vulnerability Research Team Credit: Corey Lebleu
A classic directory traversal condition exists within the Sentinel Protection Server. By sending in an HTTP GET request with a path of a file proceeded by and escaped traversal sequence, an attacker can leverage an arbitrary file access condition on the affected system.
Digital Defense, Inc. initially notified SafeNet on October 12, 2007 and received confirmation from the notification on October 30, 2007. SafeNet informed DDI that it would be releasing a patch for this flaw on November 16, 2007. At this time, DDI does not have a resolution number for the SafeNet patch for this flaw.
Sentinel Protection Server 7.1 Other versions may be vulnerable to this flaw.