|
|
| |
| The Sentinel Protection and Key Server are "two simple webservers for the monitoring of the licenses and listen respectively on ports 6002 and 7002". A directory traversal vulnerability has been discovered in both SafeNet Sentinel protection server as well as their key server. |
| |
Credit:
The information has been provided by Luigi Auriemma.
The original article can be found at: http://aluigi.altervista.org/adv/sentinella-adv.txt
|
| |
Vulnerable Systems:
* SafeNet Sentinel Protection Server version 7.4.1.0
* SafeNet Sentinel Keys Server version 7.4.1.0
Both the webservers are affected by a directory traversal vulnerability exploitable using the backslash delimiter (the servers don't support hex chars) allowing an attacker to download any file in the disk on which the services are installed.
It's funny to note that the security patch available from November 2007 was released just to fix a directory traversal vulnerability but they dropped only the slash delimiter leaving the backslash working.
Exploit:
The following packet will trigger the vulnerability:
GET /..\..\..\..\..\..\..\boot.ini HTTP/1.0
|
|
|
|
|
