Info

Disclosure

Nov 15, 2006

Discovery

Feb 01, 2006

Dates

Exploit

Nov 16, 2006

Solution

Unknown

Description

Ultraseek contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when a remote attacker passes %00 to the "url" parameter of urlstatusgo.html, which will disclose the software's installation path and process ID resulting in a loss of confidentiality. While such information is relatively low risk, it is often useful in carrying out additional, more focused attacks.

Classification

Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Confidentiality
Exploit: Exploit Public
Disclosure: OSVDB Verified
OSVDB: Web Related

Solution

Upgrade to version 5.7 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

Verity	Ultraseek	5.5.0
		5.6.0
		5.6.1
		5.6.2

References

CVE ID: 2006-5970 (see also: NVD)
Secunia Advisory ID: 22892
Related OSVDB ID: 30286 30287 30289
Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-11/0289.html
Other Advisory URL: http://zerodayinitiative.com/advisories/ZDI-06-042.html

Credit

Sullo - sullocirt.net - cirt.net

Direct URL: http://osvdb.org/30288