27 November 2007, 12:20
A vulnerability in Sentinel Protection Server allows access to data
A vulnerability in the SafeNet Sentinel Protection Server and Key Server reportedly allows access to protected information. The problem is caused by a directory traversal bug in an embedded web server. A URL of the form http://ip-adresse:6002/../../../../../../winnt/repair/sam allows a copy of a Protection Server system's Windows password file to be read remotely.
Sentinel Protection Server 7.0.0 to 7.0.4 and Sentinel Keys Server 1.0.3 are affected. The flaws have been remedied in Protection Server 7.4.1 and Keys Server 1.0.4. The vendor has published an update (ZIP file).
- Directory Traversal in SafeNet Sentinel Protection Server and Keys Server, Elliot Kendall's security advisory
(mba)
Print Version | Send by email
| Permalink: http://h-online.com/-734044
![Kernel Log: Coming in 3.10 (Part 3) [--] Infrastructure](/imgs/43/1/0/4/2/6/7/2/comingin310_4_kicker-4977194bfb0de0d7.png)
![Kernel Log: Coming in 3.10 (Part 3) [--] Infrastructure](/imgs/43/1/0/4/2/3/2/3/comingin310_3_kicker-151cd7b9e9660f05.png)
