[Full-disclosure] DDIVRT-DDIVRT-2008-15 iPhone Configuration Web Utility 1.0 for Windows Directory Traversal

[DDI_Vulnerability_Alert]

Title

-----

DDIVRT-DDIVRT-2008-15 iPhone Configuration Web Utility 1.0 for Windows
Directory Traversal

 

Severity

--------

High

 

Date Discovered

---------------

October 2, 2008

 

Discovered By

-------------

Digital Defense, Inc. Vulnerability Research Team

Credit: Corey LeBleu and r at b13$

 

Vulnerability Description

-------------------------

The iPhone Configuration Web Utility allows centralized management of
iPhone configuration settings. The iPhone Configuration Web Utility 1.0
for Windows web interface is vulnerable to a common web directory
traversal attack. Successful exploitation will result in arbitrary
read-only file access outside of the iPhone Configuration Web Utility
1.0 web root.

 

Solution Description

--------------------

Filter network traffic so that only trusted users can access the web
interface.

 

Tested Systems / Software (with versions)

------------------------------------------

Windows XP Professional

iPhone Configuration Web Utility 1.0 for Windows

 

Vendor Contact

--------------

Vendor Name: Apple Inc.

Vendor Website: www.apple.com

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20081121/ecbb582d/attachment.html