[NT] Multiple Vulnerabilities Found in Forums Web Server

From: SecuriTeam (support_at_securiteam.com)
Date: 05/31/03

  • Next message: SecuriTeam: "[REVS] Denial of Service via Algorithmic Complexity Attacks" 
    To: list@securiteam.com
Date: 31 May 2003 11:55:03 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    In the US?

    Contact Beyond Security at our new California office
    housewarming rates on automated network vulnerability
    scanning. We also welcome ISPs and other resellers!

    Please contact us at: 323-882-8286 or ussales@beyondsecurity.com
    - - - - - - - - -

      Multiple Vulnerabilities Found in Forums Web Server
    ------------------------------------------------------------------------

    SUMMARY

     <http://www.minihttpserver.net/home/> WebForums Server "allows you to
    setup a bulletin board and photo/file exchange web service. It offers a
    built in HTTP engine, internal database engine, integrated HTML/Script
    pages, user management interface, message board engine, and a secure file
    Upload/Download option". Multiple vulnerabilities have been found in the
    product allowing attackers to traverse directories they would be otherwise
    unable to, insert malicious HTML or JavaScript into existing web page,
    etc.

    DETAILS

    Vulnerable systems:
     * Forums Web Server version 1.6

    Clear text password storage:
    The Forum Web Server stores all usernames and passwords in the file
    \Program Files\Web Forums Server\User.ini. The passwords inside the file
    are stored in clear text. If a malicious user were to gain access to this
    file, they would have a list of all usernames and their associated
    passwords.

    Directory traversal:
    The Forum Web Server suffers from a directory traversal vulnerability.
    This combined with the first vulnerability, allows any remote attacker to
    view any username and password under the Forum Web Server or read
    arbitrary files on the system.

    Example:
    http://10.10.10.1/../user.ini (To get the usernames and passwords)

    Alternatively,
    http://10.10.10.1/../../../boot.ini

    Cross site scripting:
    The Forum Web Server suffers from a CSS (Cross Site Scripting)
    vulnerability. This means that any user that can post a message under the
    "Message Forum" can post a "CSS" message.

    Cookie contains username and password in clear text:
    Anyone that can capture the relevant network traffic can view the username
    and password of the user in clear text.

    Example:
    Host: 10.10.10.1
    Cookie: IDHTTPSESSIONID=3ertf3dsxfy3aqW; UserID=user10; PassWD=0000

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:vulncode@yahoo.com> Ziv
    Kamir.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[REVS] Denial of Service via Algorithmic Complexity Attacks"