('binary' encoding is not supported, stored as-is) Pi3Web/2.0.0 File-Disclosure/Path Disclosure *************************************************** Vulnerability ************* Discovered by: Teknophreak of Malloc() ************************************** Date: March 9 2002 ******************* Contact: tekat_private *************************** Pi3Web is a Webserver available for multiple Microsoft Windows platforms. There are multiple disclosure flaws within the webserver that may assist an attacker in performing more concentrated attacks against the server and also can allow the disclosure of sensitive files on the webserver. To see the webroot directory just simply cause a 404 error: http://pi3web-host.com/fake_page To view files on the web server that you are not supposted to be seen do something like: http://pi3web-host.com/*.extension Quick Fix: ------------- Don't use it or wait for vendor patch.
This archive was generated by hypermail 2b30 : Mon Mar 11 2002 - 08:59:51 PST