-----BEGIN PGP SIGNED MESSAGE----- ################################################################ # _____ __ __ ___ # # ........\ \.| |.| |/ \........ # # : / \| | | | __> : # # : / _ \ |_| | / __ : # # : / / \ | <_/ \ : # # :..../ _/ / _ | ` \....: # # : \_________/__| |__|_______/ : # # : Damage Hacking Group : # # : Security Advisory : # # :.............................: # # # # http://www.dhgroup.org # #b d# ##b,________________________________________________________.d## | | Product: Tornado www-server v1.2 Authors: www.softrex.com/tornado/ | Vulnerability: multiple bugs | #--------------------------------------------------------------# | Overview: | ~~~~~~~~~ Another one http server | | #--------------------------------------------------------------# | Problem: | ~~~~~~~~ This server is one BiG problem. IMHO is most dangerous server. Main bug in DNA ;D Attacker may see any files in system (but only if he know path and filename), may crash server (and exec malicious code) by sending long http request. Examples: www.server.com/../existing_file <-file be showed www.server.com/aa[more than 471 chars] | | #--------------------------------------------------------------# | Exploit: | ~~~~~~~~ Naah, its not interesting. Lets authors code something better. | | #--------------------------------------------------------------# | :wow: | ~~~ NeKr0 /DHG www.dhgroup.org | | #______________________________________________________________# \___________________________da_end___________________________/ Best regards www.dhgroup.org D4rkGr3y icq 540981 -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 7.0.3 for non-commercial use <http://www.pgp.com> iQCVAwUBPtaTMW4LIpseSJmPAQFU5AP/bO2H6whq/DXFdjYndYthn3sC35RlR6Lh TF9tuOZyTPzsRwf0wKZEw3ivtyoAKVL3Qn6a+kCC7XE049TViDujQ5ykevkADl41 aA1E+wqV23xZjJfLuDBuJNgl2TbaJop+qYvrE5Rh83k81q4MdGLAuwQkM57M5xch 5JSPz5M1yC0= =dw5D -----END PGP SIGNATURE-----
This archive was generated by hypermail 2b30 : Wed May 28 2003 - 21:54:48 PDT