P-Sync Password Management contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when a remote attacker requests the nph-psa.exe script with a malformed lang parameter, which will disclose the software's installation path resulting in a loss of confidentiality. While such information is relatively low risk, it is often useful in carrying out additional, more focused attacks.
Classification
Location:
Remote / Network Access
Attack Type:
Information Disclosure,
Input Manipulation
Impact:
Loss of Confidentiality
Solution:
Upgrade
Exploit:
Exploit Public
Disclosure:
Vendor Verified
OSVDB:
Web Related
Solution
Installing a filtering firewall/proxy server inline before P-Synch product should be able to filter malformed requests. Vendor has also reported that patches are now available.
gulftech.org -
GulfTech Security Research Team