-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 iDEFENSE Security Advisory 10.15.02: http://www.idefense.com/advisory/10.15.02.txt DoS and Directory Traversal Vulnerabilities in WebServer 4 Everyone October 15, 2002 I. BACKGROUND RadioBird Software's WebServer 4 Everyone is a free "Powerful, MultiClient, yet Easy to handle and maintain, WebServer.". It is available for download at http://www.freeware.lt/ . II. DESCRIPTION Issue 1: Improper bounds checking allow attackers to launch a denial of service (DoS) attack, causing the web server to crash. The condition is triggered when the software receives a request for a long filename, such as GET /AAAAAAAA...3000...AAAA HTTP/1.1 . Issue 2: A directory traversal issue exists. The software can be duped into serving a restricted file. This is done if an attacker issues a directory traversal request with the hexadecimal representation for the front slash character (%2F). For example, if the URL http://target.server/%2f..%2f..%2f../winnt/repair/sam were sent to a target server, the SAM table would be retrieved. A vulnerability exists that provides attackers access to arbitrary files on the server running the application. III. ANALYSIS For Issue 1, exploitation could allow an attacker to deny legitimate users access to the server and the contents that it provides. For Issue 2, exploitation allows an attacker to obtain sensitive information, such as the Windows NT SAM table. This kind of information can allow further compromise of the targeted host. Sensitive information such as credit cards can also be retrieved. Customers should note that an remote user with access to the application can launch these attacks. IV. DETECTION iDEFENSE has confirmed the existence of both vulnerabilities in WebServer 4 Everyone, versions 1.23 and 1.27. Earlier versions are likely affected, as well. V. VENDOR FIX Leonardas Survila of Radiobird Software released WebServer 4 Everyone, version 1.30, which fixes the problems. It is downloadable at ftp://ftp.freeware.lt/anonymous/Soft/w4asetup.exe. VI. CVE INFORMATION The Mitre Corp.'s Common Vulnerabilities and Exposures (CVE) Project assigned the identification number CAN-2002-1212 to Issue 1 and CAN-2002-1213 to Issue 2. VII. DISCLOSURE TIMELINE 10/06/2002 Issues disclosed to iDEFENSE 10/14/2002 Vendor notified via e-mail to ulteriorat_private 10/14/2002 iDEFENSE clients notified 10/14/2002 Response received from Leonardas Survila (leonardassat_private) 10/15/2002 Vendor fix created 10/15/2002 Coordinated public disclosure VIII. CREDIT Tamer Sahin (tsat_private) discovered both of these vulnerabilities. Get paid for security research http://www.idefense.com/contributor.html Subscribe to iDEFENSE Advisories: send email to listservat_private, subject line: "subscribe" About iDEFENSE: iDEFENSE is a global security intelligence company that proactively monitors sources throughout the world — from technical vulnerabilities and hacker profiling to the global spread of viruses and other malicious code. Our security intelligence services provide decision-makers, frontline security professionals and network administrators with timely access to actionable intelligence and decision support on cyber-related threats. For more information, visit http://www.idefense.com. - -dave David Endler, CISSP Director, Technical Intelligence iDEFENSE, Inc. 14151 Newbrook Drive Suite 100 Chantilly, VA 20151 voice: 703-344-2632 fax: 703-961-1071 dendlerat_private www.idefense.com -----BEGIN PGP SIGNATURE----- Version: PGP 7.1.2 Comment: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x4B0ACC2A iQA/AwUBPaxMJkrdNYRLCswqEQIabQCdEXlBmEBU0u2z09zztLpto/p0GSEAoL2j hG8hLEn20rIAAo6QitYW9/7M =JI4s -----END PGP SIGNATURE-----
This archive was generated by hypermail 2b30 : Tue Oct 15 2002 - 18:35:36 PDT