DDIVRT-DDIVRT-2008-15 iPhone Configuration Web Utility 1.0 for Windows Directory Traversal

Title

-----

DDIVRT-DDIVRT-2008-15 iPhone Configuration Web Utility 1.0 for Windows
Directory Traversal

Severity

--------

High

Date Discovered

---------------

October 2, 2008

Discovered By

-------------

Digital Defense, Inc. Vulnerability Research Team

Credit: Corey LeBleu and r_at_b13$

Vulnerability Description

-------------------------

The iPhone Configuration Web Utility allows centralized management of
iPhone configuration settings. The iPhone Configuration Web Utility 1.0
for Windows web interface is vulnerable to a common web directory
traversal attack. Successful exploitation will result in arbitrary
read-only file access outside of the iPhone Configuration Web Utility
1.0 web root.

Solution Description

--------------------

Filter network traffic so that only trusted users can access the web
interface.

Tested Systems / Software (with versions)

------------------------------------------

Windows XP Professional

iPhone Configuration Web Utility 1.0 for Windows

Vendor Contact

--------------

Vendor Name: Apple Inc.

Vendor Website: www.apple.com

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Received on Nov 21 2008