BoS: *** SECURITY ALERT *** (fwd)

[Mark_W_Loveless () smtp bnr com (Mark_W_Loveless () smtp bnr com)]

     Yes out of the box it is insecure. However in a random sampling of 10
     sites there was 1 site that restricted using ../ so (I assume) that by
     using Novell's security you CAN restrict this bug. However you can
     access files like AUTOEXEC.NCF, and even login scripts in the hidden
     _NETWARE directory (if you know the name).

     It does appear you are restricted to the SYS: volume, however if you
     are using XCONSOLE and have your remote console password in plaintext
     (instead of encrypted) you are just inviting someone to telnet to the
     server console....

     Mark_W_Loveless () smtp bnr com
     Opinions are my own, not my employer's


______________________________ Reply Separator _________________________________
Subject: BoS: *** SECURITY ALERT *** (fwd)
Author:  best-of-security () suburbia net at internet
Date:    7/3/96 9:41 PM


---------- Forwarded message ----------
Date: Wed, 3 Jul 1996 14:50:06 -0700 (PDT)
From: TTT Group <ttt () broder com>
Subject: *** SECURITY ALERT ***

I spent some time exploring Novell's HTTP server and out of the box
there is a CGI that is VERY VERY INSECURE!!!!!!!!!!!!!!!!!!!!!!!!!

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
If you are running the Novell HTTP server, please disable the CGI's
it comes with it until you understand (fully understand) what the
security risks are.
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

The CGI in question is convert.bas (yes, cgi's in basic, stop laughing).
(There may be more CGI's in the scripts dir that can be exploited
but this was all I could stomoch.)

A remote user can read any file on the remote file system using
this CGI.  This means that if you are running the Novell HTTP
server and have the 'out of box' CGI's, you are breached.
Exploit code:
http://victim.com/scripts/convert.bas?../../anything/you/want/to/view

I was going to see how bad this threat was by connecting to
www servers, testing for "Novell HTTP" in the HTTP server responce
BUT WHY DO THAT WHEN YOU HAVE www.altavista.digital.com :-)
+links:scripts/convert.bas
will return you all the sites that can be breached.

PLEASE PLEASE PLEASE don't open the box and put machine on the
Internet.  I am getting tired of this kind of stuff.
Who the hell did Novell consult with to write these darn CGI's?
It makes me sad.

- --blast

------------------------------