DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT <http://nagoya.apache.org/bugzilla/show_bug.cgi?id=16366>. ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND INSERTED IN THE BUG DATABASE.
http://nagoya.apache.org/bugzilla/show_bug.cgi?id=16366 Apache 2.0.43 File disclosure Summary: Apache 2.0.43 File disclosure Product: Apache httpd-2.0 Version: 2.0.43 Platform: Other OS/Version: Windows NT/2K Status: NEW Severity: Normal Priority: Other Component: Core AssignedTo: [email protected] ReportedBy: [EMAIL PROTECTED] Hi support, I tested an reproduced the CAN-2003-0017 vulnerability : "On Windows platforms Apache could be forced to serve unexpected files by appending illegal characters such as '<' to the request URL" fixed in 2.0.44. I made a 2.0.43 default installation on a Win2K SP2 box. By appending "<<" at the end of a request, I can list and view files on a directory. Here is how I proceed: I first try "http://target/directory/a<<". Is there is one or more files starting by character "a", then I get one of these files ( always the same but I do not know which one ). If I get an error back, then I try with the next letter and so on until I get a file back, say "f". To get the exact filename, I restart the process but with 2 letter this time i.e. "http://target/directory/fa<<". If a filename starts with "fa", I get it, otherwise I get an error. And so on until I get the filename let say "fat.html". Note that to be sure you do not miss any file in the directory, you need to try one character more than filename length (fat.htmla", "fat.htmlb"... ). Using this algorithm, I can list and view the all files on a directory. This goes beyond the unexpected file disclosure described in the release note of 2.0.44 and I thought you needed to be aware of it. I tested version 2.0.44 and as expected, it is not vulnerable. Regards. Bernard Margelin, Security Watch Manager at Vigilante, Toulouse Telephone (33) 5 62 57 70 16 email [EMAIL PROTECTED] --------------------------------------------------------------------- To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
