Vulnerable Systems:
* EAServer prior from 6.3 ESD#2
* EAServer prior from 6.3.1
This condition can result in arbitrary code execution.
The vulnerability is due to a failure by the Sybase EAServer HTTP Server to restrict directory traversals. As a result, sensitive file path locations outside the configured HTTP Server restricted directory can be accessed by an attacker. No authentication is required to access the HTTP Server.
Exploitation of this vulnerability could allow an attacker to gain control over the affected machine.
By specifying a file path with multiple directory traversal sequences such as "../\../\../\", it is possible for an attacker to access sensitive files hosted on EAServer using the privileges of the HTTP Server. An attacker may be able to read important system files, which will result in information disclosure, and can potentially lead to full host compromise.
Workaround:
The HTTP Server uses TCP port 8000 by default. This port my be firewalled on the EAServer host.
