Description
httpd.tkd in Radia Integration Server in Hewlett-Packard (HP) OpenView Configuration Management (CM) Infrastructure 4.0 through 4.2i and Client Configuration Manager (CCM) 2.0 allows remote attackers to read arbitrary files via URLs containing tilde (~) references to home directories, as demonstrated by ~root.
References
- SSRT071298 vendor-advisory
- 20071031 ZDI-07-060: HP OpenView Radia Integration Server File System Exposure Vulnerability mailing-list
- 39528 vdb-entry
- hpopenview-cm-ccm-unauthorized-access(37400) vdb-entry
- http://www.zerodayinitiative.com/advisories/ZDI-07-060.html
- 1018858 vdb-entry
- 27341 third-party-advisory
- ADV-2007-3620 vdb-entry