<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 11 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline;}
p
{mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman";}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:Verdana;
color:windowtext;
font-weight:normal;
font-style:normal;
text-decoration:none none;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.25in 1.0in 1.25in;}
div.Section1
{page:Section1;
mso-footnote-position:beneath-text;}
-->
</style>
</head>
<body lang=EN-US link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal><font size=2 face="Courier New"><span style='font-size:10.0pt;
font-family:"Courier New"'>Title<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face="Courier New"><span style='font-size:10.0pt;
font-family:"Courier New"'>-----<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face="Courier New"><span style='font-size:10.0pt;
font-family:"Courier New"'>DDIVRT-2008-17 Orb Directory Traversal<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face="Courier New"><span style='font-size:10.0pt;
font-family:"Courier New"'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face="Courier New"><span style='font-size:10.0pt;
font-family:"Courier New"'>Severity<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face="Courier New"><span style='font-size:10.0pt;
font-family:"Courier New"'>--------<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face="Courier New"><span style='font-size:10.0pt;
font-family:"Courier New"'>High<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face="Courier New"><span style='font-size:10.0pt;
font-family:"Courier New"'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face="Courier New"><span style='font-size:10.0pt;
font-family:"Courier New"'>Date Discovered<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face="Courier New"><span style='font-size:10.0pt;
font-family:"Courier New"'>---------------<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face="Courier New"><span style='font-size:10.0pt;
font-family:"Courier New"'>October, 21<sup>st</sup> 2008<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face="Courier New"><span style='font-size:10.0pt;
font-family:"Courier New"'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face="Courier New"><span style='font-size:10.0pt;
font-family:"Courier New"'>Discovered By<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face="Courier New"><span style='font-size:10.0pt;
font-family:"Courier New"'>-------------<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face="Courier New"><span style='font-size:10.0pt;
font-family:"Courier New"'>Digital Defense, Inc. Vulnerability Research Team<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face="Courier New"><span style='font-size:10.0pt;
font-family:"Courier New"'>Credit: Steven James and r@b13$<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face="Courier New"><span style='font-size:10.0pt;
font-family:"Courier New"'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face="Courier New"><span style='font-size:10.0pt;
font-family:"Courier New"'>Vulnerability Description<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face="Courier New"><span style='font-size:10.0pt;
font-family:"Courier New"'>-------------------------<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-align:justify'><font size=2 face="Courier New"><span
style='font-size:10.0pt;font-family:"Courier New"'>Orb Networks' Orb media
server is vulnerable to directory traversal attacks. Users can leverage
specially crafted GET requests to read arbitrary files. <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face="Courier New"><span style='font-size:10.0pt;
font-family:"Courier New"'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face="Courier New"><span style='font-size:10.0pt;
font-family:"Courier New"'>Solution Description<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face="Courier New"><span style='font-size:10.0pt;
font-family:"Courier New"'>--------------------<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-align:justify'><font size=2 face="Courier New"><span
style='font-size:10.0pt;font-family:"Courier New"'>Use firewall rules to restrict
access to authorized users of the Orb server.<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-align:justify'><font size=2 face="Courier New"><span
style='font-size:10.0pt;font-family:"Courier New"'>This issue is fixed in
version 2.01.0022 available at<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-align:justify'><font size=2 face="Courier New"><span
style='font-size:10.0pt;font-family:"Courier New"'> </span></font><a
href="http://www.orb.com/download/us/setup_2.01.0022.exe"><font
face="Courier New"><span style='font-family:"Courier New"'>http://www.orb.com/download/us/setup_2.01.0022.exe</span></font></a><font
size=2 face="Courier New"><span style='font-size:10.0pt;font-family:"Courier New"'>
<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face="Courier New"><span style='font-size:10.0pt;
font-family:"Courier New"'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face="Courier New"><span style='font-size:10.0pt;
font-family:"Courier New"'>Tested Systems / Software (with versions)<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face="Courier New"><span style='font-size:10.0pt;
font-family:"Courier New"'>------------------------------------------<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-align:justify'><font size=2 face="Courier New"><span
style='font-size:10.0pt;font-family:"Courier New"'>Orb version 2.01.0017 on
Windows XP Pro SP2<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-align:justify'><font size=2 face="Courier New"><span
style='font-size:10.0pt;font-family:"Courier New"'>Nullsoft Winamp Remote
Server Beta (featuring Orb version 2.01.0013) on Windows XP Pro SP2<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face="Courier New"><span style='font-size:10.0pt;
font-family:"Courier New"'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face="Courier New"><span style='font-size:10.0pt;
font-family:"Courier New"'>Vendor Contact<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face="Courier New"><span style='font-size:10.0pt;
font-family:"Courier New"'>--------------<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-align:justify'><font size=2 face="Courier New"><span
style='font-size:10.0pt;font-family:"Courier New"'>Orb Networks<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-align:justify'><font size=2 face="Courier New"><span
style='font-size:10.0pt;font-family:"Courier New"'>Website: http://www.orb.com<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face="Courier New"><span style='font-size:10.0pt;
font-family:"Courier New"'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Verdana><span style='font-size:10.0pt;
font-family:Verdana'><o:p> </o:p></span></font></p>
</div>
</body>
</html>