Description
The ePPIServlet script in Computer Associates (CA) eTrust Security Command Center 1.0 and r8 up to SP1 CR2, when running on Windows, allows remote attackers to obtain the web server path via a "'" (single quote) in the PIProfile function, which leaks the path in an error message.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- CA eSCC r8/1.0 / eTrust Audit r8/1.5 - Web Server Full Path Disclosure EDB-28640 · remote · Sep 21, 2006 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- http://users.tpg.com.au/adsl2dvp/advisories/200608-computerassociates.txt
- ca-etrust-eppiservlet-path-disclosure(29102) vdb-entry
- http://www3.ca.com/securityadvisor/blogs/posting.aspx?id=90744&pid=93243&date=2006/9
- 29009 vdb-entry
- 1016910 vdb-entry
- http://www3.ca.com/securityadvisor/vulninfo/vuln.aspx?id=34616
- 22023 third-party-advisory
- 20139 vdb-entry
- 20060922 RE: Computer Associates eTrust Security Command Center Multiple Vulnerabilities mailing-list
- 20060921 [CAID 34616, 34617, 34618]: CA eSCC and eTrust Audit vulnerabilities mailing-list
- ADV-2006-3738 vdb-entry