RE: def-2001-32 - Allaire JRun directory browsing vulnerability

From: Johan Burati (jburatiat_private)
Date: Fri Nov 30 2001 - 12:31:33 PST

Next message: staticat_private: "Re: File extensions spoofable in MSIE download dialog"

Previous message: Hasan Azam Diwan: "Re: *ALERT* BID 3581: Wu-Ftpd File Globbing Heap Corruption Vulnerability"
In reply to: Felix Huber: "Re: def-2001-32 - Allaire JRun directory browsing vulnerability"
Next in thread: null null: "Re: def-2001-32 - Allaire JRun directory browsing vulnerability"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

JRUN 3.0 with Netscape-Enterprise/4.1 running on HPUX is vulnerable too.

Regards,
Johan Burati

-----Original Message-----
From: Felix Huber [mailto:huberfelixat_private]
Sent: Friday, November 30, 2001 12:09 AM
To: bugtraqat_private
Cc: Stephen Dupre
Subject: Re: def-2001-32 - Allaire JRun directory browsing vulnerability

> > http://www.victim.com/%3f.jsp
>
> Not only IIS is affected, i found vulnerable Sites running Apache
> 1.3.19/Solaris and Apache 1.3.12/Linux.

I just got a mail from Stephen Dupre (Macromedia), he helped me a lot to
bring light in this thing. JRun seems to be fine on Solaris/Linux/HPUX (but
he still investigates this). You can find the Macromedia Advisory here:
http://www.allaire.com/handlers/index.cfm?ID=22236&Method=Full

The problem on the other sites seems to be mod_jk/mod_rewrite or Jserv
(Apache.org is contacted). But it's still unclear at the moment what causes
this behavior (Directory Listing).

Simply use the NASL File from my last Mail, it will work in any case. At the
moment even a large german Webhoster running Linux is vulnerable to this.

Regards,
Felix Huber

-------------------------------------------------------
Felix Huber, Security Consultant, Webtopia
Guendlinger Str.2, 79241 Ihringen - Germany
huberfelixat_private     (07668)  951 156 (phone)
http://www.webtopia.de     (07668)  951 157 (fax)
                                         (01792)  205 724 (mobile)
-------------------------------------------------------

Next message: staticat_private: "Re: File extensions spoofable in MSIE download dialog"
Previous message: Hasan Azam Diwan: "Re: *ALERT* BID 3581: Wu-Ftpd File Globbing Heap Corruption Vulnerability"
In reply to: Felix Huber: "Re: def-2001-32 - Allaire JRun directory browsing vulnerability"
Next in thread: null null: "Re: def-2001-32 - Allaire JRun directory browsing vulnerability"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Sat Dec 01 2001 - 10:16:56 PST