Advisory Details

November 10th, 2015

IBM System Networking Switch Center FileReader.jsp Directory Traversal Information Disclosure Vulnerability

ZDI-15-553
ZDI-CAN-3012

CVE ID CVE-2015-7817
CVSS SCORE 7.1, AV:N/AC:M/Au:N/C:C/I:N/A:N
AFFECTED VENDORS IBM
AFFECTED PRODUCTS System Networking Switch Center
VULNERABILITY DETAILS


This vulnerability allows remote attackers to disclose information on vulnerable installations of IBM System Networking Switch Center. Authentication is not required to exploit this vulnerability.

The specific flaws exist within the IBM SNSC Web Service, which listens by default on ports 40080 (HTTP) or 40443 (HTTPS) for requests to the administration panel. The first is a race condition, which allows the for the temporary use of a fixed privileged account which is forbidden from interactive login, and the second is a directory traversal vulnerability in FileReader.jsp. By combining these two vulnerabilities, an attacker can read arbitrary text files on the system.

ADDITIONAL DETAILS IBM has issued an update to correct this vulnerability. More details can be found at:
https://support.lenovo.com/us/en/product_security/len_2015_074
DISCLOSURE TIMELINE
  • 2015-06-25 - Vulnerability reported to vendor
  • 2015-11-10 - Coordinated public release of advisory
CREDIT Andrea Micalizzi (rgod)
BACK TO ADVISORIES