2007-06 Sentinel Protection Server Directory Traversal
Title
-----
Sentinel Protection Server Directory Traversal
Severity
--------
High
Date Discovered
---------------
October 10th, 2007
Discovered By
-------------
Digital Defense, Inc. Vulnerability Research Team
Credit: Corey Lebleu
Vulnerability Description
-------------------------
A classic directory traversal condition exists within the Sentinel Protection
Server. By sending in an HTTP GET request with a path of a file proceeded by
and escaped traversal sequence, an attacker can leverage an arbitrary file
access condition on the affected system.
Solution Description
--------------------
Digital Defense, Inc. initially notified SafeNet on October 12, 2007 and
received confirmation from the notification on October 30, 2007. SafeNet
informed DDI that it would be releasing a patch for this flaw on November 16,
2007. At this time, DDI does not have a resolution number for the SafeNet
patch for this flaw.
Tested Systems / Software (with versions)
-----------------------------------------
Sentinel Protection Server 7.1
Other versions may be vulnerable to this flaw.
Vendor Contact
--------------
SafeNet
http://www.safenet-inc.com/