CVE:CVE-2007-3985
CNNVD:CNNVD-200707-458
SecurityReporter是Sidewinder安全设备的安全事件分析和报表解决方案。
SecurityReporter的file.cgi文件没有规格化用户输入及过滤句号和斜线/反斜线，可能导致目录遍历攻击：
165 #on windows 2003 IIS the cur dir is the root itself- dont know why so we try to open it in
166 #path relative to root if ../ from cgi-bin fails
167 open(f, "../$name") or open(f, "$name") or die "File($name): $!";
solution:Upgrade securecomputing securityreporter to a higher version than 4.6.3,and avoid the version 4.6.3