FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2008-6508

This CVE name corresponds to:

Entered	Topic
2008-11-19	openfire -- multiple vulnerabilities

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2008-6508 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2008-6508
Phase	Assigned(20090323)

Description

Directory traversal vulnerability in the AuthCheck filter in the Admin Console in Openfire 3.6.0a and earlier allows remote attackers to bypass authentication and access the admin interface via a .. (dot dot) in a URI that matches the Exclude-Strings list, as demonstrated by a /setup/setup-/.. sequence in a URI.

References

Source	Reference
BUGTRAQ	20081108 [AK-ADV2008-001] Openfire Jabber-Server: Multiple Vulnerabilities (Authentication Bypass, SQL injection, ...)
MILW0RM	7075
MISC	http://www.andreas-kurtz.de/advisories/AKADV2008-001-v1.0.txt
MISC	http://www.andreas-kurtz.de/archives/63
CONFIRM	http://www.igniterealtime.org/builds/openfire/docs/latest/changelog.html
CONFIRM	http://www.igniterealtime.org/issues/browse/JM-1489
BID	32189
OSVDB	49663
SECUNIA	32478
VUPEN	ADV-2008-3061
XF	openfire-authcheckfilter-security-bypass(46488)