defaultroute has reported a vulnerability in BlueCat Networks Proteus, which can be exploited by malicious users to bypass certain security restrictions.

The vulnerability is caused due to an input validation error within the TFTP functionality in the Proteus Admin Interface. This can be exploited to create or overwrite files with root privileges on an Adonis DNS/DHCP appliance via files containing directory traversal sequences in the file name.

Successful exploitation allows to compromise an Adonis appliance, but requires administrative privileges with access to the TFTP services on the Proteus system.

The vulnerability is reported in Proteus version 2.0.2.0. Other versions may also be affected.

Solution
Update to version 2.0.5.

Provided and/or discovered by
defaultroute, Template Security

Changelog
Further details available in Customer Area

Original Advisory
http://archives.neohapsis.com/archives/bugtraq/2007-08/0074.html
http://archives.neohapsis.com/archives/bugtraq/2007-08/0123.html

Deep Links
Links available in Customer Area