netwin netauth 4.2 - Directory Traversal

Author: Marc Maiffret
type: remote
platform: cgi
port: 0
date_added: 2000-08-17
date_updated: 2012-08-01
verified: 1
codes: CVE-2000-0782;OSVDB-393
tags: 
aliases: 
screenshot_url: 
application_url: 

source: https://www.securityfocus.com/bid/1587/info

A remote user is capable of gaining read access to any known file residing on a host running Netwin Netauth through directory traversal. Appending a series of '../' and the desired file name to the 'page' variable at the end of a request to netauth.cgi will allow a remote user to walk the entire directory tree above the Netauth directory.

For example:

http://target/cgi-bin/netauth.cgi?cmd=show&page=../../directory

will display the contents of the specified directory.