SurfControl SuperScout WebFilter for Windows 2000 - File Disclosure

Author: Matt Moore
type: remote
platform: windows
port: 
date_added: 2002-10-02 
date_updated: 2012-10-11 
verified: 1 
codes: CVE-2002-0708;OSVDB-3493 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/5857/info

SurfControl SuperScout WebFilter Reports Server is prone to a vulnerability which may allow remote attackers to disclose the contents of arbitrary files.

The Reports Server does not sufficiently filter triple-dot-slash (.../) sequences from web requests. As a result, an attacker may break out of the root directory for the reporting service and browse the filesystem at large, disclosing arbitrary files that are readable by the Reports Server.

http://reports-server:8888/.../.../.../.../.../.../.../winnt/win.ini