CVE-2008-0396

Directory traversal vulnerability in BitDefender Update Server (http.exe), as used in BitDefender products including Security for Fileservers and Enterprise Manager (BDEM), allows remote attackers to read arbitrary files via .. (dot dot) sequences in an HTTP request.

CVSS v2.0 7.8 HIGH

7.8^/10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:C/I:N/A:N

Exploitability : 10.0 / Impact : 6.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://oliver.greyhat.de/2008/01/19/bitdefender-unauthorized-remote-file-access-vulnerability/
http://www.oliverkarow.de/research/bitdefender.txt	Exploit
http://www.securityfocus.com/bid/27358	Exploit
http://secunia.com/advisories/28578	Vendor Advisory
http://securityreason.com/securityalert/3568
http://www.vupen.com/english/advisories/2008/0213
https://exchange.xforce.ibmcloud.com/vulnerabilities/39802
http://www.securityfocus.com/archive/1/486701/100/0/threaded

Configurations

Configuration 1 (hide)

cpe:2.3:a:bitdefender:update_server:*:*:*:*:*:*:*:*

Information

Published : 2008-01-23 04:00

Updated : 2018-10-15 14:59

NVD link : CVE-2008-0396

Mitre link : CVE-2008-0396

JSON object : View

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Products Affected

bitdefender

update_server

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://oliver.greyhat.de/2008/01/19/bitdefender-unauthorized-remote-file-access-vulnerability/", "name": "http://oliver.greyhat.de/2008/01/19/bitdefender-unauthorized-remote-file-access-vulnerability/", "tags": [], "refsource": "MISC"}, {"url": "http://www.oliverkarow.de/research/bitdefender.txt", "name": "http://www.oliverkarow.de/research/bitdefender.txt", "tags": ["Exploit"], "refsource": "MISC"}, {"url": "http://www.securityfocus.com/bid/27358", "name": "27358", "tags": ["Exploit"], "refsource": "BID"}, {"url": "http://secunia.com/advisories/28578", "name": "28578", "tags": ["Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://securityreason.com/securityalert/3568", "name": "3568", "tags": [], "refsource": "SREASON"}, {"url": "http://www.vupen.com/english/advisories/2008/0213", "name": "ADV-2008-0213", "tags": [], "refsource": "VUPEN"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39802", "name": "bitdefender-http-server-directory-traversal(39802)", "tags": [], "refsource": "XF"}, {"url": "http://www.securityfocus.com/archive/1/486701/100/0/threaded", "name": "20080119 BitDefender Update Server - Unauthorized Remote File Access Vulnerability", "tags": [], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Directory traversal vulnerability in BitDefender Update Server (http.exe), as used in BitDefender products including Security for Fileservers and Enterprise Manager (BDEM), allows remote attackers to read arbitrary files via .. (dot dot) sequences in an HTTP request."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-22"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2008-0396", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 7.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "COMPLETE"}, "severity": "HIGH", "impactScore": 6.9, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2008-01-23T12:00Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:bitdefender:update_server:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-15T21:59Z"}

7.8 /10