SafeNet Sentinel Web Interface Remote Directory Traversal Vulnerability


Description   A vulnerability has been identified in SafeNet Sentinel Protection Server and Sentinel Keys Server, which could be exploited by attackers to bypass security restrictions and gain knowledge of sensitive information. This issue is caused by an input validation error in the web interface when handling specially crafted HTTP requests, which could be exploited by remote attackers to access and read the contents of arbitrary files via a directory traversal.
     
Vulnerable Products   Vulnerable Software:
SafeNet Sentinel Protection Server versions prior to 7.4.1SafeNet Sentinel Keys Server versions prior to 1.0.4
     
Solution   Upgrade to SafeNet Sentinel Protection Server version 7.4.1 and SafeNet Sentinel Keys Server version 1.0.4 : http://www.safenet-inc.com/support/index.asp
     
CVE   CVE-2007-6483
     
References  
     
Vulnerability Manager Detection   No
     
IPS Protection  
ASQ Engine alarm Available Since
Misc : Directory traversal - parameter starting with ../
3.2.0
Directory traversal using ..\..
3.2.0
Directory traversal
3.2.0
     


 
 
 
 
 Risk level 
Moderate 

 Vulnerability First Public Report Date 
2007-11-27 

 Target Type 
Server 

 Possible exploit 
Local & Remote