WinGate contains a flaw that allows an attacker to traverse outside of a restricted path. The issue is due to the log service not properly sanitizing user input, specifically directory traversal style attacks (e.g., ../../). This directory traversal attack would allow the attacker to gain access to arbitrary files.

Upgrade to version 4.1 Beta C or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

• Exploit Database: 19383
• Bugtraq ID: 507
• Mail List Post: http://archives.neohapsis.com/archives/ntbugtraq/1998-1999/msg00511.html
  http://seclists.org/bugtraq/2000/Oct/17
• Other Advisory URL: http://www.eeye.com/database/advisories/ad02221999/ad02221999.html
• Vendor URL: http://www.wingate.com/

• Marc - eEye Digital Security Team

NVD does not currently have a CVSSv2 score assigned.