Luigi Auriemma has discovered some vulnerabilities in ExtremeZ-IP File and Print Server, which can be exploited by malicious people to disclose potentially sensitive information or cause a DoS (Denial of Service).

1) An input validation error in the ExtremeZ-IP Service (ExtremeZ-IP.exe) when handling SLP (Service Location Protocol) "Server Reply" functions can be exploited to crash the service via a specially crafted packet sent to default port 427/UDP.

2) An error in the ExtremeZ-IP Service when handling UAM strings in e.g. a AFP (Apple Filling Protocol) FPLogin command can be exploited to crash the service via a specially crafted packet sent to default port 548/TCP.

3) An input validation error in the ExtremeZ-IP Service when processing HTTP requests can be exploited to download certain files (e.g. .gif, .png, .jpg, .xml, .ico, .zip, .html) via directory traversal attacks.

The vulnerabilities are confirmed in version 5.1.2x15. Other versions may also be affected.

Solution
Apply hotfix (ExtremeZ-IP 5.1.3x03).
Further details available in Customer Area

Provided and/or discovered by
Luigi Auriemma

Changelog
Further details available in Customer Area

Original Advisory
http://aluigi.altervista.org/adv/ezipirla-adv.txt

Deep Links
Links available in Customer Area