[NT] KF WebServer Directory Traversal Vulnerability

From: SecuriTeam (support_at_securiteam.com)
Date: 07/21/05

  • Next message: SecuriTeam: "[TOOL] Binhex - Convert Files Generated by Xbin or Macget Into BinHex Format" 
    To: list@securiteam.com
Date: 21 Jul 2005 13:36:20 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      KF WebServer Directory Traversal Vulnerability
    ------------------------------------------------------------------------

    SUMMARY

    " <http://www.keyfocus.net/kfws/> KF Web Server is a free HTTP Server that
    can host an unlimited number of web sites."

    By crafting a special HTTP URL and sending it to the KF web server,
    attackers can cause the product to return content from directories that
    would be otherwise inaccessible.

    DETAILS

    Vulnerable Systems:
     * KF Web Server version 2.5.0

    Exploit:
    http://[victim_address]/All%20Disk%20Drives/C:/

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:basher13@linuxmail.org> eric
    basher.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[TOOL] Binhex - Convert Files Generated by Xbin or Macget Into BinHex Format"

    Relevant Pages

    • [NT] Xedus Webserver Directory Traversal and DoS
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... The Xedus web server is vulnerable to a directory traversal. ... this vulnerability constitutes a denial of ...
      (Securiteam)
    • [UNIX] Apache mod_proxy_ftp Undefined Charset UTF-7 XSS Vulnerability
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Apache mod_proxy_ftp Undefined Charset UTF-7 XSS Vulnerability ... Apache has been the most popular web server on the Internet since April ...
      (Securiteam)
    • [NT] Quick n Easy/Baby Web Server ASP Code Disclosure
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Quick 'n Easy/Baby Web Server ASP Code Disclosure ... Quick 'n Easy Web Server version 3.1.1 ... 22/03/2006 - Initial vendor notification ...
      (Securiteam)
    • [NEWS] IP Phones Based on PA168 Chipset Have Weak Session Management
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... IP Phones Based on PA168 Chipset Have Weak Session Management ... admin web console running as superuser. ... is for them to send a well-formed request to the web server. ...
      (Securiteam)
    • [NT] PMSoftware Simple Web Server Buffer Overflow
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... HTTP Web Server" ... The information in this bulletin is provided "AS IS" without warranty of any kind. ... In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. ...
      (Securiteam)