McAfee ASaP Directory Traversal

Reported July 11, 2001, [email protected].

VERSION AFFECTED

DESCRIPTION
A vulnerability exists inthe myCIO HTTP server that installs as part of McAfee’s AsaP virus-scanning softwarepackage. By connecting to the server running on port 6515 and using a speciallyformatted directory traversal URL format, an attacker can break out of the rootWeb directory and view or download files on the system if the attacker knows thefile location.

DEMONSTRATION 

The discoverer, [email protected], also provided thefollowing example as proof-of-concept:

http://:6515/.../.../.../.../winnt/repair

VENDOR RESPONSE

Thevendor, McAfee, was notified on June 28,2001. As a suitable workaround, users can run the service under a local useraccount (it installs using the SYSTEM account) and grant permissionsaccordingly.

CREDIT
Discoveredby [email protected].