VMware Studio Web Interface Upload Directory Traversal Vulnerability


Description   A vulnerability has been identified in VMware Studio, which could be exploited by attackers to bypass security restrictions and potentially compromise a vulnerable system. This issue is caused by an input validation error in a support component of the web interface, which could be exploited to upload a file to any directory inside the VMware Studio virtual appliance.
     
Vulnerable Products   Vulnerable Software:
VMware Studio version 2.0 beta
     
Solution   Upgrade to VMware Studio version 2.0 build 1017-185256 : http://www.vmware.com/support/developer/studio/
     
CVE   CVE-2009-2968
     
References   http://lists.vmware.com/pipermail/security-announce/2009/000064.html
http://www.vmware.com/support/developer/studio/studio20/release_notes.html
     
Vulnerability Manager Detection   No
     
IPS Protection  
ASQ Engine alarm Available Since
Misc : Directory traversal - parameter starting with ../
3.2.0
Directory traversal using ..\..
3.2.0
Directory traversal
3.2.0
Directory traversal backward root folder
3.2.0
     


 
 
 
 
 Risk level 
Moderate 

 Vulnerability First Public Report Date 
2009-09-01 

 Target Type 
Server 

 Possible exploit 
Local & Remote