Directory traversal in LANDesk Management Suite 8.80.1.1

2008-04-03T00:00:00
ID SECURITYVULNS:DOC:19555
Type securityvulns
Reporter Securityvulns
Modified 2008-04-03T00:00:00

Description

                         Luigi Auriemma

Application: LANDesk Management Suite http://www.landesk.com/products/ldms/index.aspx Versions: <= 8.80.1.1 Platforms: Windows Bug: directory traversal Exploitation: remote Date: 01 Apr 2008 Author: Luigi Auriemma e-mail: aluigi@autistici.org web: aluigi.org

1) Introduction 2) Bug 3) The Code 4) Fix

=============== 1) Introduction ===============

LANDesk is a well known system management software.

====== 2) Bug ======

The PXE TFTP Service is vulnerable to a classical directory traversal vulnerability exploitable through the adding of one or more chars before the usual dotdot pattern.

The interesting thing is that version 8.80.1.1 has been released just to fix another directory traversal vulnerability.

=========== 3) The Code ===========

http://aluigi.org/testz/tftpx.zip

tftpx SERVER x\..\..\..\..\..\..\..\boot.ini none tftpx SERVER what_you_want/../../../../../../../windows/win.ini none

====== 4) Fix ======

No fix


Luigi Auriemma http://aluigi.org