Directory traversal vulnerability in ELOG before 2.6.1 allows remote attackers to access arbitrary files outside of the elog directory via "../" (dot dot) sequences in the URL.

Several security problems have been found in elog, an electronic logbook to manage notes. The Common Vulnerabilities and Exposures Project identifies the following problems :

  - CVE-2005-4439     'GroundZero Security' discovered that elog     insufficiently checks the size of a buffer used for     processing URL parameters, which might lead to the     execution of arbitrary code.

  - CVE-2006-0347     It was discovered that elog contains a directory     traversal vulnerability in the processing of '../'     sequences in URLs, which might lead to information     disclosure.

  - CVE-2006-0348     The code to write the log file contained a format string     vulnerability, which might lead to the execution of     arbitrary code.

  - CVE-2006-0597     Overly long revision attributes might trigger a crash     due to a buffer overflow.

  - CVE-2006-0598     The code to write the log file does not enforce bounds     checks properly, which might lead to the execution of     arbitrary code.

  - CVE-2006-0599     elog emitted different errors messages for invalid     passwords and invalid users, which allows an attacker to     probe for valid user names.

  - CVE-2006-0600     An attacker could be driven into infinite redirection     with a crafted 'fail' request, which has denial of     service potential.

The remote host appears to be using ELOG, a web-based electronic logbook application.  The version of ELOG installed on the remote host fails to filter directory traversal strings before processing GET requests.  An attacker can exploit this issue to retrieve the contents of arbitrary files from the remote host, subject to the privileges under which ELOG runs.  In addition, the application is reportedly affected by a format string vulnerability in the 'write_logfile'.  Provided logging is enabled, an attacker may be able to exploit this via the 'uname' parameter of the login form to crash the application or execute arbitrary code remotely.

The remote host appears to be using ELOG, a web-based electronic logbook application. 

The version of ELOG installed on the remote host fails to filter directory traversal strings before processing GET requests.  An attacker can exploit this issue to retrieve the contents of arbitrary files from the remote host, subject to the privileges under which ELOG runs. 

In addition, the application is reportedly affected by a format string vulnerability in the 'write_logfile'.  Provided logging is enabled, an attacker may be able to exploit this via the 'uname' parameter of the login form to crash the application or execute arbitrary code remotely.

ID	Name	Product	Family	Type	Severity
22833	Debian DSA-967-1 : elog - several vulnerabilities	Nessus	Debian Local Security Checks	Local	high
3379	ELOG < 2.6.2 Multiple Vulnerabilities	Nessus Network Monitor	CGI		high
20750	ELOG < 2.6.1 Multiple Remote Vulnerabilities (Traversal, FS)	Nessus	CGI abuses	Remote	medium

Detections

Analytics

CVE-2006-0347

high

Tenable Plugins

high

high

medium