[原文]Directory traversal vulnerability in the "Shell Folders" capability in Microsoft Windows Server 2003 allows remote attackers to read arbitrary files via .. (dot dot) sequences in a "shell:" link.
Microsoft Windows Server 2003 Shell Folders Arbitrary File Access
Remote / Network Access
Input Manipulation
Loss of Confidentiality,
Loss of Integrity
Exploit Public
-
漏洞描述
Windows Server 2003 contains a flaw that allows a remote attacker to read arbitrary files outside of the "Shell Folders" directory. The issue is due to the server not properly sanitizing user input, specifically traversal style attacks (../../) supplied via a malicious link.
-
时间线
2003-10-08
Unknow
2003-10-08
Unknow
-
解决方案
Currently, there are no known workarounds or upgrades to correct this issue. However, Microsoft has released Service Pack 1 (SP1) to address this vulnerability.
生活只有在平淡无味的人看来才是空虚而平淡无味的。