Nessus Plugin #11079

Plugin Index

Note: This file has been created from a downloaded version of the Nessus Plugins from http://www.nessus.org/. Therefore, the information here can be outdated.

Snapstream PVS web directory traversal

Family:

CGI abuses

Category:

attack

Copyright:

This script is Copyright (C) 2002 Michel Arboi

Summary:

Snapstream web directory traversal

Version:

$Revision: 1.7 $

Cve_id:

CVE-2001-1108

Bugtraq_id:

3100

Xrefs:

-

Description:

It is possible to read arbitrary files on the remote
Snapstream PVS server by prepending ../../ in front on the
file name.
It may also be possible to read ../ssd.ini which contains
many informations on the system (base directory, usernames &
passwords).

Solution : Upgrade your software or change it!
Risk factor : High