('binary' encoding is not supported, stored as-is) Abyss WebServer Brute Force Vulnerability Package: Abyss WebServer Vendor Web Site: http://www.aprelium.com Versions: All versions <= v1.1.2 Platforms: Linux, Windows Local: No Remote: Yes Fix Available: No(fix in progress) Vendor Contacted: Sunday, February 09, 2003 6:12 PM Advisory Author: thomas adams(tgadamsat_private) Background: Abyss Web Server is a free, easily configured web server designed for Windows and Linux operating systems. The vendor, Aprelium, targets small businesses and personal use with this "fast, small and easy to use" server. The main feature is a remote web management interface where a user can configure the server in a matter of minutes. Exploit: By connecting to the remote web management interface at http://abyss_server:9999 an attacker can use a brute-force method to gain access to the server. There is no delay in a wrong attempt and attackers are given an indefinite number of attempts at entering a valid user and password. Unlike the access.log file for port 80, Abyss has no logging for port 9999. This allows an attacker to perform unseen. Vendor Response: Aprelium was notified and will soon release an updated version of the server to include a fix for the brute-force attack and logging of port 9999. The vendor was also notified of several directories and files having write priviledges. It was agreed that a user should set permissions themselves, but there is no documentation telling a user what has write access by default. Aprelium has also decided to add a fix for the default permissions of directories and files.
This archive was generated by hypermail 2b30 : Wed Feb 12 2003 - 13:36:50 PST