RSA enVision contains a flaw that allows a remote attacker to traverse outside of a restricted path. The issue is due to the program not properly sanitizing user input, specifically directory traversal style attacks (e.g., ../../). This directory traversal attack would allow the attacker to read arbitrary files.

Upgrade to version 4.1 Patch 4 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

• Security Tracker: 1026819
• CVE ID: 2012-0403 (see also: NVD)
• Secunia Advisory ID: 48484
• Bugtraq ID: 52557
• ISS X-Force ID: 74139
• Related OSVDB ID: 80206 80207 80208 80209
• Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2012-03/att-0081/ESA-2012-014.txt

• Not Available