{"vuid":"VU#628411","idnumber":"628411","name":"OpenConnect Webconnect read-only directory traversal vulnerability in jretest.html","keywords":["jretest.html"],"overview":"OpenConnect Webconnect contains a read-only directory traversal vulnerability in the file jretest.html.","clean_desc":"OpenConnect Webconnect provides secured web access and emulation services for backend mainframes and UNIX servers. Versions of Webconnect prior to 6.4.5 and 6.5.1 running on all operating systems have a read-only directory traversal vulnerability. By sending a specially-crafted GET request, INI-style files outside of the web server root directory will be incorrectly parsed and have individual attribute values exposed in an error message. Files exposed by jretest.html must be formatted in an INI-style format popularized by Microsoft Windows: [section] attribute1 = value1\nattribute2 = value2, value3, value4 Per the OpenConnect Vendor Statement for VU#628411: The file being accessed must be in ini-style to be parsed within WebConnect. The jretest.html page will attempt to retrieve a user configuration value from that file. When the value is found to be invalid, it is displayed within the returned error html page. This allows the end user to see the value for one key within the ini-style file. The entire file is not displayed to the user nor can the user manipulate the file in any way. This vulnerability is present in all platform versions of WebConnect but is Windows-focused due to the need for the target file to be ini-style.","impact":"Exploitation of this read-only directory traversal vulnerability discloses limited types of information. Per the OpenConnect Vendor Statement for VU#628411: The file being accessed must be in ini-style to be parsed within WebConnect. The jretest.html page will attempt to retrieve a user configuration value from that file. When the value is found to be invalid, it is displayed within the returned error html page. This allows the end user to see the value for one key within the ini-style file. The entire file is not displayed to the user nor can the user manipulate the file in any way. This vulnerability is present in all platform versions of WebConnect but is Windows-focused due to the need for the target file to be ini-style.","resolution":"Affected sites should upgrade to a corrected version of WebConnect, versions 6.4.5 and 6.5.1. Licensed users can send mail to OpenConnect technical support mailto: ocs_support@oc.com,  or call +1-972-888-0678.","workarounds":"","sysaffected":"","thanks":"Thanks to \nDennis Rand\n of the \nDanish Computer Incident Response Team\n for reporting this vulnerability.","author":"This document was written by Jeff S Havrilla and based on the OpenConnect WebConnect Development team statement, with contributions from Dennis Rand.","public":["http://www.cirt.dk/advisories/cirt-29-advisory.pdf","http://www.openconnect.com/solutions/webconnect.jsp"],"cveids":["CVE-2004-0465"],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2005-02-09T17:20:21Z","publicdate":"2005-02-21T00:00:00Z","datefirstpublished":"2005-02-21T17:18:08Z","dateupdated":"2005-02-21T17:18:17Z","revision":15,"vrda_d1_directreport":"","vrda_d1_population":"","vrda_d1_impact":"","cam_widelyknown":"15","cam_exploitation":"0","cam_internetinfrastructure":"4","cam_population":"11","cam_impact":"8","cam_easeofexploitation":"9","cam_attackeraccessrequired":"10","cam_scorecurrent":"2.8215","cam_scorecurrentwidelyknown":"3.564","cam_scorecurrentwidelyknownexploited":"6.534","ipprotocol":"","cvss_accessvector":"","cvss_accesscomplexity":"","cvss_authentication":null,"cvss_confidentialityimpact":"","cvss_integrityimpact":"","cvss_availabilityimpact":"","cvss_exploitablity":null,"cvss_remediationlevel":"","cvss_reportconfidence":"","cvss_collateraldamagepotential":"","cvss_targetdistribution":"","cvss_securityrequirementscr":"","cvss_securityrequirementsir":"","cvss_securityrequirementsar":"","cvss_basescore":"","cvss_basevector":"","cvss_temporalscore":"","cvss_environmentalscore":"","cvss_environmentalvector":"","metric":2.8215,"vulnote":null}