Brendan Coles has discovered two security issues in Zen Load Balancer, which can be exploited by malicious people to disclose system and potentially sensitive information.

1) The application does not properly restrict access to the config/global.conf file and can be exploited to disclose certain system information.

2) The application does not properly restrict access to the backup directory and can be exploited to list and download arbitrary backups and subsequently disclose system and potentially sensitive information.

The security issues are confirmed in version 2 stable. Other versions may also be affected.

Solution
Upgrade to version 3.02.

Provided and/or discovered by
Brendan Coles, IT Security Solutions

Changelog
Further details available to Secunia VIM customers

Original Advisory
Zen Load Balancer:
http://freecode.com/projects/zen-load-balancer

Brendan Coles:
http://itsecuritysolutions.org/2012-09-21-ZEN-Load-Balancer-v2.0-and-v3.0-rc1-multiple-vulnerabilities/

Deep Links
Links available to Secunia VIM customers