[Full-disclosure] APC PowerChute Network Shutdown 2.21 is vulnerable to directory transversal
guinness.stout at gmail.com
Fri Jun 1 18:21:02 BST 2007
Synopsis: APC PowerChute Network Shutdown 2.21 is vulnerable to directory
Background: APC PowerChute Network Shutdown is used to perform graceful
shutdowns of network servers from one main server.
Affected Versions: <= 2.21 build 116
Description: APC PowerChute Network Shutdown is vulnerable to a directory
transversal by appending special characters such as %5c and %2e to the end
of a URL. This is due to an existing vulnerability in Acme.Serve which is a
Java HTTP server which PowerChute Network Shutdown is built on.
Vendor Notified April 9th 2007
Vendor Response April 10th 2007 "A fix is being worked on for the next
April 25th 2007 Spoke to vendor again, no ETA.
May 3rd 2007 No ETA.
June 1st 2007 No ETA.
"An ounce of prevention is worth a pound of cure."
-------------- next part --------------
An HTML attachment was scrubbed...
Full-Disclosure is hosted and sponsored by Secunia.