Secunia

Some vulnerabilities have been reported in IBM Director, which can be exploited by malicious people to disclose sensitive information and cause a DoS (Denial of Service).

1) Input passed to the "file" parameter in Redirect.bat isn't properly sanitised before being used. This can be exploited to disclose the content of arbitrary files via directory traversal attacks.

Example:
http://[host]:411/cgi-bin/Redirect.bat?file=%7C..\..\..\..\..\..\....\..\[file]

2) An unspecified error in the handling of malformed requests for the WMI CIM server can be exploited to crash a vulnerable service.

3) An unspecified error in the processing of malformed packets can be exploited to crash the IBM Director server.

4) It is possible to access cookie and authentication data in HTTP headers via the HTTP TRACE functionality.

Solution
Update to version 5.10.

Provided and/or discovered by
Reported by the vendor and Daniel Clemens.

Changelog
Further details available in Customer Area

Original Advisory
IBM:
ftp://ftp.software.ibm.com/pc/pccbbs/pc_servers_pdf/dir5.10_docs_relnotes.pdf

Daniel Clemens:
http://milw0rm.com/exploits/2320

Deep Links
Links available in Customer Area