mailing list archives
iDEFENSE Security Advisory 10.15.02: DoS and Directory Traversal Vulnerabilities in WebServer 4 Everyone
From: "David Endler" <dendler () idefense com>
Date: Tue, 15 Oct 2002 13:12:35 -0400
-----BEGIN PGP SIGNED MESSAGE-----
iDEFENSE Security Advisory 10.15.02:
DoS and Directory Traversal Vulnerabilities in WebServer 4 Everyone
October 15, 2002
RadioBird Software's WebServer 4 Everyone is a free "Powerful,
MultiClient, yet Easy to handle and maintain, WebServer.". It is
available for download at http://www.freeware.lt/ .
Improper bounds checking allow attackers to launch a denial of
service (DoS) attack, causing the web server to crash. The condition
is triggered when the software receives a request for a long
filename, such as GET /AAAAAAAA...3000...AAAA HTTP/1.1 .
A directory traversal issue exists. The software can be duped into
serving a restricted file. This is done if an attacker issues a
directory traversal request with the hexadecimal representation for
the front slash character (%2F). For example, if the URL
http://target.server/%2f..%2f..%2f../winnt/repair/sam were sent to a
target server, the SAM table would be retrieved.
A vulnerability exists that provides attackers access to arbitrary
files on the server running the application.
For Issue 1, exploitation could allow an attacker to deny legitimate
users access to the server and the contents that it provides.
For Issue 2, exploitation allows an attacker to obtain sensitive
information, such as the Windows NT SAM table. This kind of
information can allow further compromise of the targeted host.
Sensitive information such as credit cards can also be retrieved.
Customers should note that an remote user with access to the
application can launch these attacks.
iDEFENSE has confirmed the existence of both vulnerabilities in
WebServer 4 Everyone, versions 1.23 and 1.27. Earlier versions are
likely affected, as well.
V. VENDOR FIX
Leonardas Survila of Radiobird Software released WebServer 4
Everyone, version 1.30, which fixes the problems. It is downloadable
VI. CVE INFORMATION
The Mitre Corp.'s Common Vulnerabilities and Exposures (CVE) Project
assigned the identification number CAN-2002-1212 to Issue 1 and
CAN-2002-1213 to Issue 2.
VII. DISCLOSURE TIMELINE
10/06/2002 Issues disclosed to iDEFENSE
10/14/2002 Vendor notified via e-mail to ulterior () freeware lt
10/14/2002 iDEFENSE clients notified
10/14/2002 Response received from Leonardas Survila
(leonardass () iki lt)
10/15/2002 Vendor fix created
10/15/2002 Coordinated public disclosure
Tamer Sahin (ts () securityoffice net) discovered both of these
Get paid for security research
Subscribe to iDEFENSE Advisories:
send email to listserv () idefense com, subject line: "subscribe"
iDEFENSE is a global security intelligence company that proactively
monitors sources throughout the world from technical
vulnerabilities and hacker profiling to the global spread of viruses
and other malicious code. Our security intelligence services provide
decision-makers, frontline security professionals and network
administrators with timely access to actionable intelligence
and decision support on cyber-related threats. For more information,
David Endler, CISSP
Director, Technical Intelligence
14151 Newbrook Drive
Chantilly, VA 20151
dendler () idefense com
-----BEGIN PGP SIGNATURE-----
Version: PGP 7.1.2
-----END PGP SIGNATURE-----
- iDEFENSE Security Advisory 10.15.02: DoS and Directory Traversal Vulnerabilities in WebServer 4 Everyone David Endler (Oct 16)