Release Date: 2003-11-27
Critical: Moderately critical
Impact: Exposure of sensitive information
Where: From remote
Software: bitfolge snif 1.x
Description:
A vulnerability has been reported in snif, allowing malicious people to download arbitrary files.
The problem is that the "download" parameter isn't verified, which can be exploited by suppling arbitrary path and file names.
Versions prior to 1.2.5 are vulnerable.
Solution:
Update to version 1.2.5:
http://www.bitfolge.de/?l=en&s=snif
Reported by / credits:
Jay
Original Advisory:
http://www.bitfolge.de/?l=en&s=snif
Source: Secunia