 |
|
Directory Traversal in Dino's Webserver
|
|
I. BACKGROUND
Anders Jensen's Dino's Webserver is an HTTP server. The product's website is located at http://home.no.net/~nextgen/.
II. DESCRIPTION
Exploitation of a vulnerability in the latest version of Dino's Webserver could allow an attacker to view and retrieve any file on the system.
III. ANALYSIS
An attacker can construct a URL that would cause Dino's Webserver to navigate to any desired folder in the same logical drive and access the files in it. This can be achieved by using the URL encoded character representations of "/" and "\". This allows a user to traverse the server to any directory on the same logical drive as the web application. e.g.
http://$host/%2f..%2f..%2f..$directory$file.
This issue is similar to CVE-2002-0111, which involved a traditional directory traversal flaw that was fixed.
IV. DETECTION
Dino's Webserver 1.2 is affected.
V. WORKAROUND
No workaround is available as of this writing.
VI. VENDOR FIX/RESPONSE
Anders Jensen (outdoors@tiscali.no) said the following:
"My webserver will be removed from the downloads that I control, I neither have the time or resources to do anything else at the moment."
The public download site, http://home.no.net/~nextgen/ has been replaced with the following message:
"Dino's FunSoft is no longer available. the software will maybe sometime in the future be available on another label, but when and if for sure I really cannot tell, sorry. Dino_"
Dino's Webserver remains available via many other download sites such as Download.com, etc., however.
VII. CVE INFORMATION
The Mitre Corp.'s Common Vulnerabilities and Exposures (CVE) Project assigned the identification number CAN-2002-1133 for this issue.
VIII. DISCLOSURE TIMELINE
8/10/2002 Issue disclosed to iDEFENSE
9/6/2002 Issue disclosed to vendor
9/6/2002 iDEFENSE clients notified
9/14/2002 Vendor response received
9/23/2002 Issue disclosed to public
IX. CREDIT
Tamer Sahin (ts@securityoffice.net) is credited with discovering this vulnerability.
|
|
