Title: Technote Inc Technote 'filename' Parameter Command Execution And File Disclosure Vulnerability
Severity: CRITICAL
Description:
Technote Inc. offers a multi-communication Package that includes a web board type of service.
A script that ships with Technote, main.cgi, accepts a parameter called 'filename'. This remotely supplied variable is used as a filename when the open() function is called. In addition to allowing the attacker to specify a file to be opened remotely, the variable is not checked for '../' character sequences. As a result, a malicious remote user can specify any file on the file system as this variable (by using '../' sequences followed by its real path), which will be opened by the script. It's contents will then be disclosed to the attacker.
This issue is also reported to facilitate arbitrary command execution as well. Apparently it is possible to execute arbitrary commands by specifying a file that does not exist on the server and then using shell pipe characters to execute arbitrary commands. This issue may allow an attacker to execute arbitrary commands on the underlying system, potentially facilitating unauthorized access to the affected computer.
Successful exploitation of this vulnerability could lead to the disclosure of sensitive information and arbitrary system command execution, possibly assisting in further attacks against the affected computer. Commands executed in this way will execute with the privileges of the affected application.
Update: This vulnerability has been updated; previously it was classified strictly as a file disclosure vulnerability. New information has become available that suggests that this issue may be leveraged to execute arbitrary commands on the affected computer as well.
Affected Products:
- Technote Technote 2000
- Technote Technote 2001
- Technote Technote Pro
References:
- Technote Inc.: Technote Homepage
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
