Hello everyone, was the server rebooted after the patch was installed? I just setup a SafeNet Sentinel Protection Server SafeNet Sentinel Keys Server 7.4 and the exploit worked. Once I isntalled the patch, and rebooted, when I try to run the exploit the server repsonds with "The Page Cannot be Displayed" Take Care --John -------------- Original message ---------------------- From: Luigi Auriemma <aluigi@xxxxxxxxxxxxx> > > ####################################################################### > > Luigi Auriemma > > Application: SafeNet Sentinel Protection Server > SafeNet Sentinel Keys Server > http://www.safenet-inc.com > Versions: <= 7.4.1.0 (aka SPI740SecurityPatch) > Platforms: Windows > Bug: directory traversal > Exploitation: remote > Date: 10 Feb 2008 > Author: Luigi Auriemma > e-mail: aluigi@xxxxxxxxxxxxx > web: aluigi.org > > > ####################################################################### > > > 1) Introduction > 2) Bug > 3) The Code > 4) Fix > > > ####################################################################### > > =============== > 1) Introduction > =============== > > > The Sentinel Protection and Key Server are two simple webservers for > the monitoring of the licenses and listen respectively on ports 6002 > and 7002. > > > ####################################################################### > > ====== > 2) Bug > ====== > > > Both the webservers are affected by a directory traversal > vulnerability exploitable using the backslash delimiter (the servers > don't support hex chars) allowing an attacker to download any file in > the disk on which the services are installed. > > It's funny to note that the security patch available from November 2007 > was released just to fix a directory traversal vulnerability but they > dropped only the slash delimiter leaving the backslash working. > > > ####################################################################### > > =========== > 3) The Code > =========== > > > GET /..\..\..\..\..\..\..\boot.ini HTTP/1.0 > > > ####################################################################### > > ====== > 4) Fix > ====== > > > No fix > > > ####################################################################### > > > --- > Luigi Auriemma > http://aluigi.org
