|
Windows Server 2003 "Shell Folders" Directory Traversal
|
|
Secunia Advisory:
|
SA9989
|
|
|
Release Date:
|
2003-10-10
|
|
Last Update:
|
2005-04-04
|
|
Popularity:
|
20,396 views
|
|
|
Critical:
|
Not critical
|
|
Impact:
|
Security Bypass
|
|
Where:
|
From remote
|
|
Solution Status:
|
Vendor Patch
|
|
| OS: | Microsoft Windows Server 2003 Datacenter Edition
Microsoft Windows Server 2003 Enterprise Edition
Microsoft Windows Server 2003 Standard Edition
Microsoft Windows Server 2003 Web Edition
|
|
| Software: | Microsoft Internet Explorer 6.x
|
|
|
Secunia CVSS-2 Score:
|
Available in Secunia business solutions 
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities
|
|
| Advisory Content (Page 1 of 3) | [ 1 ] [ 2 ] [ 3 ] | |
|
Description:
A vulnerability has been reported in Internet Explorer for Windows Server 2003, which can be exploited by malicious people to open arbitrary, known files on a user's system.
The vulnerability is caused due to an input validation error. This can be exploited to open arbitrary, known files outside of "Shell Folders" directories by constructing a link, which uses the "shell:" URI handler and contains the "\.." character sequence.
Example:
<a href="shell:cache\..\..\Local Settings\existing_file.html">
Successful exploitation allows opening arbitrary, known files on a user's system (including files associated with the user profile without having to guess the username).
This vulnerability is not considered critical in itself. However, it may pose a threat if combined with vulnerabilities that can be exploited to place malicious files on a user's system.
Change Page:
[ 1 ] [ 2 ] [ 3 ]
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
