Spentera Research has discovered a vulnerability in Distinct Intranet Servers, which can be exploited by malicious people to disclose system information and compromise a vulnerable system.

The vulnerability is caused due to an input validation error when processing GET and PUT requests and can be exploited to download or manipulate files in arbitrary locations outside the TFTP root via directory traversal sequences.

The vulnerability is confirmed in version 3.10. Prior versions may also be affected.

Solution
Update to version 3.11.

Provided and/or discovered by
Tom Gregory, Spentera Research

Original Advisory
http://www.spentera.com/advisories/2012/SPN-01-2012.pdf

Deep Links
Links available to Secunia VIM customers