[NT] BadBlue Web Server Directory Contents Disclosure
From: support@securiteam.comDate: 06/05/02
- Previous message: support@securiteam.com: "[UNIX] Remotely Exploitable Format String Bug in Squid"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
From: support@securiteam.com To: list@securiteam.com Date: Wed, 5 Jun 2002 09:11:03 +0200 (CEST)
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
When was the last time you checked your server's security?
How about a monthly report?
http://www.AutomatedScanning.com - Know that you're safe.
- - - - - - - - -
BadBlue Web Server Directory Contents Disclosure
------------------------------------------------------------------------
SUMMARY
<http://www.badblue.com/> BadBlue is a well-known small-scale web server
for sharing files with remote users. The server, by default, will not let
a user view the contents of a directory. By appending the HTTP encoding
variant of "%" (hex 25) it will cause the web server to display the
contents of the current directory.
DETAILS
Vulnerable systems:
* BadBlue Web Server version 1.7.0
Immune systems:
* BadBlue Web Server version 1.7.1
Vendor Status:
Vendor has been contacted and has produced a fix.
Product Fix:
Version: BadBlue Personal Edition v1.7.1 May 28, 2002
Windows 95 and NT 4
<http://www.badblue.com/bb95.exe> http://www.badblue.com/bb95.exe
Windows 95, ME, 2000, XP
<http://www.badblue.com/bb98.exe> http://www.badblue.com/bb98.exe
ADDITIONAL INFORMATION
The information has been provided by <mailto:p0pt4rtz@hotmail.com> p0p
t4rtz and <mailto:bit@columbus.rr.com> Bit.
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
- Previous message: support@securiteam.com: "[UNIX] Remotely Exploitable Format String Bug in Squid"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
