A vulnerability has been reported in 3Com TippingPoint SMS Server, which can be exploited by malicious people to disclose certain system information.

The vulnerability is caused due to access control errors on certain directories that are accessible via the web management interface. This can potentially be exploited to disclose configuration settings if the device settings are being backed up into the directories.

The vulnerability has been reported in version 2.2. Other versions may also be affected.

Solution
Update to version 2.2.1.4478 (SMS_2.2.1_4478.pkg).
Further details available in Customer Area

Provided and/or discovered by
Discovered by Micheal Cottingham and reported via ZDI.

Original Advisory
3Com:
http://www.3com.com/securityalert/alerts/3COM-06-002.html

Zero Day Initiative:
http://www.zerodayinitiative.com/advisories/ZDI-06-013.html

Deep Links
Links available in Customer Area