LocalWEB 2000 Insecure Password Storage

I. BACKGROUND

Philip Curnow's LocalWEB2000 is an HTTP server for Microsoft Corp.'s Windows operating system. More information is available at http://www.intranet-server.co.uk .

II. DESCRIPTION

Issuing a URL request such as http://localweb.http.server/users.lst to a vulnerable LocalWEB 2000 server can allow access to the plaintext password file stored within (this is the document root directory, i.e. C:\Program Files\LocalWEB\users.lst).

III. ANALYSIS

Access to the password file allows an attacker to potentially gain access to all protected virtual directories on an affected LocalWEB 2000 server.

IV. DETECTION

LocalWEB2000 Professional 2.1.0 is affected. To determine susceptibility, attempt to retrieve the /users.lst file via a web session.

V. WORKAROUND

Under LocalWEB's configuration settings, change the document root virtual directory to a less predictable folder.

VI. VENDOR RESPONSE

Curnow said he is unable to currently support the current release of LocalWEB 2000.

VII. CVE INFORMATION

The Mitre Corp.'s Common Vulnerabilities and Exposures (CVE) Project has assigned the identification number CAN-2002-1353 to this issue.

VIII. DISCLOSURE TIMELINE

08/29/2002 Issue disclosed to iDEFENSE
09/24/2002 Author notified (philip@curnow37.freeserve.co.uk)
09/25/2002 Response from Author
09/25/2002 iDEFENSE clients notified
09/25/2002 - 12/10/2002 iDEFENSE and Author Communication
12/16/2002 Public Disclosure

IX. CREDIT

Tamer Sahin (ts@securityoffice.net) discovered this vulnerability.