Multiple directory traversal vulnerabilities in the (1) WebAccess Agent and (2) Document Viewer Agent components in Novell GroupWise before 8.02HP allow remote attackers to read arbitrary files via unspecified vectors. NOTE: some of these details are obtained from third party information.
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Link | Tags |
---|---|
http://secunia.com/advisories/40820 | third party advisory vendor advisory |
https://bugzilla.novell.com/show_bug.cgi?id=638646 | |
http://www.novell.com/support/viewContent.do?externalId=7007156&sliceId=1 | vendor advisory |
https://bugzilla.novell.com/show_bug.cgi?id=638644 | |
http://www.facebook.com/note.php?note_id=477865030928 |