|
|
Sybex E-Trainer 相对路径过滤器目录遍历漏洞
发布时间：2002-02-18
更新时间：2002-02-18
严重程度：中
威胁程度：远程非授权文件存取
错误类型：输入验证错误
利用方式：服务器模式
BUGTRAQ ID：4071
受影响系统Sybex E-Trainer
- Microsoft Windows 2000 Advanced Server
- Microsoft Windows 2000 Advanced Server SP1
- Microsoft Windows 2000 Advanced Server SP2
- Microsoft Windows 2000 Datacenter Server
- Microsoft Windows 2000 Datacenter Server SP1
- Microsoft Windows 2000 Datacenter Server SP2
- Microsoft Windows 2000 Professional
- Microsoft Windows 2000 Professional SP1
- Microsoft Windows 2000 Professional SP2
- Microsoft Windows 2000 Server
- Microsoft Windows 2000 Server SP1
- Microsoft Windows 2000 Server SP2
- Microsoft Windows 95
- Microsoft Windows 95 SR2
- Microsoft Windows 98
- Microsoft Windows 98SE
- Microsoft Windows NT Enterprise Server 4.0
- Microsoft Windows NT Enterprise Server 4.0SP1
- Microsoft Windows NT Enterprise Server 4.0SP2
- Microsoft Windows NT Enterprise Server 4.0SP3
- Microsoft Windows NT Enterprise Server 4.0SP4
- Microsoft Windows NT Enterprise Server 4.0SP5
- Microsoft Windows NT Enterprise Server 4.0SP6
- Microsoft Windows NT Enterprise Server 4.0SP6a
- Microsoft Windows NT Server 4.0
- Microsoft Windows NT Server 4.0SP1
- Microsoft Windows NT Server 4.0SP2
- Microsoft Windows NT Server 4.0SP3
- Microsoft Windows NT Server 4.0SP4
- Microsoft Windows NT Server 4.0SP5
- Microsoft Windows NT Server 4.0SP6
- Microsoft Windows NT Server 4.0SP6a
- Microsoft Windows NT Terminal Server 4.0
- Microsoft Windows NT Terminal Server 4.0SP1
- Microsoft Windows NT Terminal Server 4.0SP2
- Microsoft Windows NT Terminal Server 4.0SP3
- Microsoft Windows NT Terminal Server 4.0SP4
- Microsoft Windows NT Terminal Server 4.0SP5
- Microsoft Windows NT Terminal Server 4.0SP6
- Microsoft Windows NT Terminal Server 4.0SP6a
- Microsoft Windows NT Workstation 4.0
- Microsoft Windows NT Workstation 4.0SP1
- Microsoft Windows NT Workstation 4.0SP2
- Microsoft Windows NT Workstation 4.0SP3
- Microsoft Windows NT Workstation 4.0SP4
- Microsoft Windows NT Workstation 4.0SP5
- Microsoft Windows NT Workstation 4.0SP6
- Microsoft Windows NT Workstation 4.0SP6a 详细描述
E-Trainer 是一个商业的基于计算机的培训软件。使用于Microsoft Windows 95,
98, NT 4.0, 和 2000 平台。
E-trainer没有很好的过滤输入，用户可以提送包含相对路径的字符串，导致目录
遍历，以HTTP进程身份查看任意文件。
测试代码
http://target/netget?sid=user&msg=300&file=/../../../filename.ext
解决方案
尚无
相关信息
参考：http://www.securityfocus.com/archive/1/255408
|
