Vulnerability

    Master Index

Affected

    Linux/UNIX with Master Index

Description

    Following   is   based   on   a   Synnergy  Laboratories  Advisory
    SLA-2000-16.  Synnergy Labs has  found a flaw within Master  Index
    that allows a  user to successfully  traverse the filesystem  on a
    remote host, allowing arbitary files/folders to be read.

    Master Index  is a  professional search  engine such  as Yahoo and
    Alta  Vista.   This  search  engine  supports  loads  of features.
    Admins can  set script  to automatically  add submissions  or wait
    until confirmed  by the  admin, users  can edit  and delete  their
    listings,    admins    can    add/edit/delete    categories    and
    sub-categories, and supports unlimited listings.  Product  pricing
    is $199.95 US

     Master Index can be found at:

        http://www.armadastyle.com/masterindex.html

    Synnergy has recently discovered  a flaw within Master  Index that
    allows a remote  user to traverse  the filesystem as  a request to
    the script  using the  $catigory=_some_dir_variable.   It is  then
    possible to read any file or folder's contents with priviledges as
    the httpd.

    Example:

        http://www.target.com/cgi-bin/search/search.cgi?keys=*&prc=any&catigory=../../../../../../../../etc

    The above line  if given will  output all the  directories and the
    file contents, that are nested within /etc directory.  Other  more
    sinister content can be revealed from there.

    Due  to  the  commercial  license  of the product advisory authors
    where unable to check the code for the exact bug, or even for  the
    discovery of more bugs.

Solution

    The vendors have been informed of the bug.  It is advised to  wait
    for the next patched version of Master Index to be released.