Secunia

Dr_insane has discovered two vulnerabilities in ADA Image Server, which can be exploited by malicious people to compromise a vulnerable system or gain knowledge of sensitive information.

1) A boundary error within a routine for evaluating requested resources can be exploited to cause a buffer overflow via an overly long (about 1000 bytes) HTTP GET request.

Successful exploitation may allow execution of arbitrary code.

2) An input validation error can be exploited to access directories outside the web root via either the classic "../" directory traversal character sequence or the URL encoded representation of the "..//" character sequence.

This vulnerability can be combined with another recently disclosed vulnerability to view the content of arbitrary directories.

For more information:
SA11277

The vulnerabilities have been reported in versions 0.4 and 0.5 for Windows. Other versions may also be affected.

Solution
Update to version 0.6.21 or later.
Further details available in Customer Area

Provided and/or discovered by
Dr_insane

Changelog
Further details available in Customer Area

Original Advisory
http://members.lycos.co.uk/r34ct/main/ADA%20Image%20Server%20(ImgSvr)%200.4.txt
http://members.lycos.co.uk/r34ct/main/Ada_image_server_0.5.txt

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area