TITLE:
LogiSphere Directory Traversal and Potential Denial of Service

SECUNIA ADVISORY ID:
SA17989

VERIFY ADVISORY:
http://secunia.com/advisories/17989/

CRITICAL:
Less critical

IMPACT:
Exposure of system information, Exposure of sensitive information,
DoS

WHERE:
>From remote

SOFTWARE:
LogiSphere 0.x
http://secunia.com/product/6458/

DESCRIPTION:
dr_insane has discovered two vulnerabilities in LogiSphere, which can
be exploited by malicious users to access arbitrary files on a
vulnerable system and potentially to cause a DoS (Denial of
Service).

1) An input validation error in the URL makes it possible to escape
the web root and retrieve arbitrary files on the system via directory
traversal attacks using the "../../" character sequence.

2) The server does not limit the number of messages that can be sent
by a user using the "msg" command. This may be exploited to display a
large number of message boxes on the server via the "msg" command.

Example:
http://[host]:8080/msg[message]

The vulnerabilities have been confirmed in version 0.9.9j. Other
versions may also be affected.

SOLUTION:
Restrict access to trusted users only.

PROVIDED AND/OR DISCOVERED BY:
dr_insane

ORIGINAL ADVISORY:
http://www.ipomonis.com/advisories.htm

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------