----------------------------------------------------------------------

Want to work within IT-Security?

Secunia is expanding its team of highly skilled security experts.
We will help with relocation and obtaining a work permit.

Currently the following type of positions are available:
http://secunia.com/hardcore_disassembler_and_reverse_engineer/

----------------------------------------------------------------------

TITLE:
CruiseWorks Directory Traversal and Buffer Overflow Vulnerabilities

SECUNIA ADVISORY ID:
SA22139

VERIFY ADVISORY:
http://secunia.com/advisories/22139/

CRITICAL:
Moderately critical

IMPACT:
Exposure of sensitive information, System access

WHERE:
>From local network

SOFTWARE:
CruiseWorks 1.x
http://secunia.com/product/12403/

DESCRIPTION:
Tan Chew Keong has reported two vulnerabilities in CruiseWorks, which
can be exploited by malicious users to gain knowledge of sensitive
information and compromise a vulnerable system.

1) Input passed to the "doc" parameter in "/scripts/cruise/cws.exe"
is not properly sanitised before being used to display files. This
can be exploited to disclose the contents of arbitrary files via
directory traversal attacks.

2) A boundary error within the processing of input passed to the
"doc" parameter in "/scripts/cruise/cws.exe" can be exploited to
cause a stack-based buffer overflow via an overly long string (more
than 512 bytes).

Successful exploitation allows execution of arbitrary code.

The vulnerabilities are reported in versions 1.09c and 1.09d.

SOLUTION:
Update to version 1.09e.

PROVIDED AND/OR DISCOVERED BY:
Tan Chew Keong

ORIGINAL ADVISORY:
Kynoslogic:
http://www.kynos.co.jp/cruise/cws/cwsdownload_upinfo1_09e.html

vuln.sg
http://vuln.sg/cruiseworks109d-en.html

OTHER REFERENCES:
JVN:
http://jvn.jp/cert/JVNVU%23176908/index.html
http://jvn.jp/cert/JVNVU%23338652/index.html

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------