SiteBar contains a flaw that allows a REMOTE attacker to traverse outside of a restricted path. The issue is due to the SCRIPT not properly sanitizing user input, specifically directory traversal style attacks (e.g., ../../) supplied via the dir parameter. This directory traversal attack would allow the attacker to retrieve arbitrary files.

The SiteBar application translation module can be made to read any arbitrary file that the web server user has read access to, as it makes no sanity checks on the value passed within the dir parameter of the URL, for example:

http://192.168.1.1/translator.php?dir=/etc/passwd%00

Note the use of %00 to terminate the malicious and so prevent the intended
string concatenation occuring.

Upgrade to version 3.3.9 or higher, as it has been reported to fix this vulnerability. In addition, the vendor has released a patch for some older versions.

• CVE ID: 2007-5694 (see also: NVD)
• Bugtraq ID: 26126
• Secunia Advisory ID: 27503 28008
• Related OSVDB ID: 41110 41355 41356 41357 41358 41359 41581 43604 43760
• VUPEN Advisory: ADV-2007-3768
• Other Advisory URL: http://securityreason.com/securityalert/3318
  http://www.debian.org/security/2007/dsa-1423
  http://www.nth-dimension.org.uk/pub/NDSA20071016.txt.asc
• Vendor Specific News/Changelog Entry: http://teamforge.net/viewcvs/viewcvs.cgi/tags/release-3.3.9/doc/history.txt?view=markup
• Vendor Specific Solution URL: http://www.gentoo.org/security/en/glsa/glsa-200711-05.xml
• Vendor URL: http://www.sitebar.org/
• Keyword: NDSA20071016

• Tim Brown - Nth Dimension