Description
Directory traversal vulnerability in Computer Associates (CA) eTrust Security Command Center 1.0 and r8 up to SP1 CR2, allows remote authenticated users to read and delete arbitrary files via ".." sequences in the eSCCAdHocHtmlFile parameter to eSMPAuditServlet, which is not properly handled by the getadhochtml function.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- CA eSCC r8/1.0 / eTrust Audit r8/1.5 - Arbitrary File Manipulation EDB-28641 · remote · Sep 21, 2006 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- http://users.tpg.com.au/adsl2dvp/advisories/200608-computerassociates.txt
- http://www3.ca.com/securityadvisor/blogs/posting.aspx?id=90744&pid=93243&date=2006/9
- 1016910 vdb-entry
- http://www3.ca.com/securityadvisor/vulninfo/vuln.aspx?id=34617
- 22023 third-party-advisory
- 29010 vdb-entry
- ca-etrust-esmpauditservlet-dir-traversal(29104) vdb-entry
- 20139 vdb-entry
- 20060922 RE: Computer Associates eTrust Security Command Center Multiple Vulnerabilities mailing-list
- 20060921 [CAID 34616, 34617, 34618]: CA eSCC and eTrust Audit vulnerabilities mailing-list
- ADV-2006-3738 vdb-entry