[NT] Northern Solutions WebMan Webserver Arbitrary File Disclosure

From: support@securiteam.com
Date: 07/12/02 

From: support@securiteam.com
To: list@securiteam.com
Date: Fri, 12 Jul 2002 08:21:51 +0200 (CEST)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

When was the last time you checked your server's security?
How about a monthly report?
http://www.AutomatedScanning.com - Know that you're safe.
- - - - - - - - -

  Northern Solutions WebMan Webserver Arbitrary File Disclosure
------------------------------------------------------------------------

SUMMARY

 <http://www.northernsolutions.com/> WebMan Web server is designed by
Northern Solutions. It is proposed as a high scale webserver. The daemon
is vulnerable to dot-dot-slash directory transversal attacks.

DETAILS

Vulnerable systems:
 * WebMan version 0.9

Exploit:
For example, in order to access the SAM' backup copy, one could provide
the following URL:
http://server/../windows/repair/sam

Vendor Status:
The vendor has been contacted and has produced a fix.

Product Fix:
The updated daemon is available at Northern Solutions site.
 <http://www.northernsolutions.com/index.php?view=getdownload&id=1&loc=1>
http://www.northernsolutions.com/index.php?view=getdownload&id=1&loc=1

ADDITIONAL INFORMATION

The information has been provided by p0p t4rtz for Sitedude.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages

  • [UNIX] Buffer Overflow in PostgreSQL (cash_words)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... The information in this bulletin is provided "AS IS" without warranty of any kind. ... In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. ...
    (Securiteam)
  • [TOOL] FlashFXP sites.dat Decryption
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... The information in this bulletin is provided "AS IS" without warranty of any kind. ... In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. ...
    (Securiteam)
  • [TOOL] LKL, Linux Key Logger
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... The information in this bulletin is provided "AS IS" without warranty of any kind. ... In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. ...
    (Securiteam)
  • [NT] Norton Antivirus Content Filter and Virus Protection Can By Passed
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... The information in this bulletin is provided "AS IS" without warranty of any kind. ... In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. ...
    (Securiteam)
  • [TOOL] WPoison SQL Injection Stress Testing
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... The information in this bulletin is provided "AS IS" without warranty of any kind. ... In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. ...
    (Securiteam)