Re: [Full-disclosure] Directory traversal in SafeNet Sentinel Protection and Key Server 7.4.1.0

[Luigi Auriemma <aluigi@xxxxxxxxxxxxx>]

jfvanmeter@xxxxxxxxxxx wrote:
> Interresting, how are you running the Get command? Is safenet
> installed on a workstation or server? 

Here I have Windows XP Pro SP2.
All the tests have been made using the raw GET request as I reported in
my advisory using netcat because the browsers usually modify the
delimiters or just the entire URI, for example IE converts backslashes
in slashes while Firefox drops ../ and converts \ in %5c.


--- 
Luigi Auriemma
http://aluigi.org

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/