OSVDB ID: 4079 Title: BadBlue MS Office Viewing Script Traversal Arbitrary File Access |
Info |
|
|
Dates |
||||
|
|
Description |
BadBlue contains a flaw that allows a remote attacker to access arbitrary files outside of the web path. The issue is due to the MS Office Viewing script not properly sanitizing user input, specifically traversal style attacks (../../). |
Classification |
Location:
Remote/Network Access Required
Attack Type: Input Manipulation Impact: Loss of Confidentiality, Loss of Integrity Exploit: Exploit Available Disclosure: OSVDB Verified OSVDB: Web Related |
Solution |
Upgrade to version 1.6.1 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds. |
Products |
|
References |
|
Credit |
|
labs.secureance.com -