Multiple issues have been identified in Sun iPlanet Directory Server with Administration Express allowing malicious users to escalate their privileges.

1) The ViewLog function allows the user to supply arbitrary paths and filenames using the character sequence "%2f..":

Example:
/admin-serv/tasks/configuration/ViewLog?file=passwd&num=5000&str=
&directories=admin-serv%2Flogs%2f..%2f..%2f..%2f..%2f..%2f..%2fetc&id=admin-serv

2) Multiple setuid "root" applications are accessible to local users. This could possibly be exploited to gain access to restricted ressources or escalate privileges.

Solution
Upgrading to iPlanet Directory Server 5.1 Service Pack 2 or Sun ONE Directory Server 5.2 fixes these issues.

Provided and/or discovered by
Jim Hardisty
Mark Brewis, EDS

Deep Links
Links available in Customer Area