TippingPoint Zero Day Initiative
 

Novell NetIQ Sentinel Server ReportViewServlet fileName Directory Traversal Information Disclosure Vulnerability

ZDI-16-406: July 7th, 2016

CVE ID

CVSS Score

Affected Vendors

Affected Products

Vulnerability Details


This vulnerability allows remote attackers to disclose arbitrary file contents on vulnerable installations of Novell NetIQ Sentinel Server. Authentication is required to exploit this vulnerability but it can be bypassed using a separate flaw within the LogonFormController.

The specific flaw exists within the ReportViewServlet servlet. When fileType is specified as "PREVIEW", the fileName parameter is vulnerable to directory traversal. An attacker could leverage this vulnerability to read the content of arbitrary files from the system.

Vendor Response

Novell has issued an update to correct this vulnerability. More details can be found at:

Disclosure Timeline

    2016-05-09 - Vulnerability reported to vendor
    2016-07-07 - Coordinated public release of advisory

Credit

This vulnerability was discovered by:
    rgod