Tassi Raeburn has discovered a vulnerability in IPCheck Server Monitor, which can be exploited by malicious people to gain knowledge of sensitive information.

The vulnerability is caused due to an input validation error in the built-in web interface (port 8080/TCP) and can be exploited to disclose the contents of arbitrary files on the system via directory traversal attacks.

Example:
http://[host]:8080/images%2f..%2f..%2f..%2f..%2f[file]

The vulnerability has been confirmed in version 5.3.2.616 and also reported in versions 4.3.1.368, 4.3.1.382, 5.1.0.342, 5.2.0.404, 5.3.0.508, and 5.3.2.609. Other versions may also be affected.

Solution
Update to version 5.3.3.639/640.
Further details available to Secunia VIM customers

Provided and/or discovered by
Tassi Raeburn

Changelog
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers