CVE:CVE-2010-0154
CNNVD:CNNVD-201009-114
Local Management Interface是基本帧中继规范的增强集。
包含固件的IBM Proventia Network Mail Security System (PNMSS)应用程序2.5.0.2之前版本中的Local Management Interface (LMI)中的sla/index.php文件中存在目录遍历漏洞。远程认证用户可以借助l参数中的".."(点点)符读取任意文件。该漏洞与"Insecure Direct Object Reference漏洞"有关。
solution:Upgrade ibm proventia_network_mail_security_system_virtual_appliance to a higher version than *; Upgrade ibm proventia_network_mail_security_system_virtual_appliance_firmware to a higher version than 1.6,and avoid the version 1.6