English
The Internet threat alert status is currently normal. At present, no major epidemics or other serious incidents have been recorded by Kaspersky Lab’s monitoring service. Internet threat level: 1

Gefest Web Home Server Directory Traversal Vulnerability


Secunia ID

SA38477

Release Date

09 Feb 2010

Criticality

Moderately Critical

Solution Status

Vendor Patch

Software

Gefest Web Home Server 1.x

Where

From remote

Impact
Exposure of sensitive information

Vulnerabilities where documents or credentials are leaked or can be revealed either locally or from remote.

Description

A vulnerability has been reported in Gefest Web Home Server, which can be exploited by malicious people to disclose sensitive information.

Input passed via HTTP requests is not properly verified before being used to access files, which can be exploited to e.g. disclose the content of files outside of the web root directory via directory traversal attacks.

The vulnerability is reported in versions prior to 1.2.

Solution

Update to version 1.2.
http://clearweb.org.ua/download_now.htm

Reported by

MarkoT, Corelan Team

Original Advisory

Clear Web:
http://clearweb.org.ua/download_now.htm

Corelan Team:
http://www.corelan.be:8800/index.php/forum/security-advisories/corelan-10-010-gefest-web-homeserver-directory-traversal/