[prev in list] [next in list] [prev in thread] [next in thread] 

List:       full-disclosure
Subject:    [Full-disclosure] Limited directory traversal in NeroNET 1.2.0.2
From:       Luigi Auriemma <aluigi () autistici ! org>
Date:       2005-11-02 19:34:49
Message-ID: 20051102203449.6570d3bd.aluigi () autistici ! org
[Download RAW message or body]


#######################################################################

                             Luigi Auriemma

Application:  NeroNET
              http://www.nero.com
Versions:     <= 1.2.0.2
Platforms:    Windows
Bug:          limited directory traversal
Exploitation: remote
Date:         02 Nov 2005
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    http://aluigi.altervista.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


NeroNET is a web server which allows Nero users to use a CD/DVD burner
remotely.


#######################################################################

======
2) Bug
======


The program is affected by a classical directory traversal bug which
can be exploited by anyone since the directories used as base for the
attack (www and status) are publics and do NOT require authorization.
Both slash and backslash and the relative HTTP encoded chars are
allowed.
The limitation of this bug is that only some file extensions are
allowed:

  nri, nrg, zip, dvi, rtf, ppt, pdf, mpe, mpeg, mpg, mov, qt, vob, avi,
  wav, mp3, bmp, tiff, tif, jpe, jpeg, jpg, gif, log, txt, sdp, css,
  js, html, htm

The check made by NeroNET is only on the beginning of the extension so
JSP or JSWHATYOUWANT are allowed extensions since JS is in the list.


#######################################################################

===========
3) The Code
===========


  http://host/www/..%2f..%5c../..../folder/file.txt


#######################################################################

======
4) Fix
======


No fix.
No reply from the vendor.


#######################################################################


--- 
Luigi Auriemma 
http://aluigi.altervista.org 
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
[prev in list] [next in list] [prev in thread] [next in thread] 

Configure | About | News | Add a list | Sponsored by KoreLogic