[VulnWatch] [SCSA-017] Directory Traversal Vulnerability in EZ Server

From: Gregory Le Bras | Security Corporation (gregory.lebras@security-corporation.com)
Date: 04/17/03

  • Next message: Matthew Murphy: "[VulnWatch] Race in XP SCM Service Shutdown Mechanism" 
    From: "Gregory Le Bras | Security Corporation" <gregory.lebras@security-corporation.com>
To: <vulnwatch@vulnwatch.org>
Date: Thu, 17 Apr 2003 01:29:15 +0200

    ======================================================================
    Security Corporation Security Advisory [SCSA-017]

    Directory Traversal Vulnerability in EZ Server
    ======================================================================

    PROGRAM: EZ Server
    HOMEPAGE: http://www.html-helper.com
    VULNERABLE VERSIONS: 1.0 and prior ?
    RISK: Medium/High
    IMPACT: Directory Traversal
    RELEASE DATE: 2003-04-17

    Security Corporation's Free weekly Newsletter :
    http://www.security-corporation.com/index.php?id=newsletter

    ======================================================================
    TABLE OF CONTENTS
    ======================================================================

    1..........................................................DESCRIPTION
    2..............................................................DETAILS
    3..............................................................EXPLOIT
    4............................................................SOLUTIONS
    5........................................................VENDOR STATUS
    6..............................................................CREDITS
    7...........................................................DISCLAIMER
    8...........................................................REFERENCES
    9.............................................................FEEDBACK

    1. DESCRIPTION
    ======================================================================

    EZ Server is a "compact multi-threaded server has both HTTP and FTP
    built right into it." (direct quote from http://www.html-helper.com)

    2. DETAILS
    ======================================================================

    ¤ Directory Traversal :

    A security vulnerability in EZ HTTP server allows remote attackers to
    gain access to system files.

    3. EXPLOIT
    ======================================================================

    ¤ Directory Traversal :

    http://[target]/../../winnt/win.ini

    4. SOLUTIONS
    ======================================================================

    No solution for the moment.

    5. VENDOR STATUS
    ======================================================================

    The vendor has reportedly been notified.

    6. CREDITS
    ======================================================================

    Discovered by Gregory Le Bras <gregory.lebras@security-corporation.com>

    7. DISLAIMER
    ======================================================================

    The information within this paper may change without notice. Use of
    this information constitutes acceptance for use in an AS IS condition.
    There are NO warranties with regard to this information. In no event
    shall the author be liable for any damages whatsoever arising out of
    or in connection with the use or spread of this information. Any use
    of this information is at the user's own risk.

    8. REFERENCES
    ======================================================================

    - Original Version:
      http://www.security-corporation.com/index.php?id=advisories&a=017

    - Version Française:
      http://www.security-corporation.com/index.php?id=advisories&a=017-FR

    9. FEEDBACK
    ======================================================================

    Please send suggestions, updates, and comments to:

    Security Corporation
    http://www.security-corporation.com
    info@security-corporation.com

  • Next message: Matthew Murphy: "[VulnWatch] Race in XP SCM Service Shutdown Mechanism"

    Relevant Pages

    • SecurityFocus Microsoft Newsletter #171
      ... Better Management for Network Security ... GoodTech Telnet Server Remote Denial Of Service Vulnerabilit... ... ASPApp PortalAPP Remote User Database Access Vulnerability ...
      (Focus-Microsoft)
    • SecurityFocus Microsoft Newsletter #174
      ... This issue sponsored by: Tenable Network Security ... the worlds only 100% passive vulnerability ... MICROSOFT VULNERABILITY SUMMARY ... Novell Netware Enterprise Web Server Multiple Vulnerabilitie... ...
      (Focus-Microsoft)
    • SecurityFocus Microsoft Newsletter # 150
      ... - automatically set positive security policies for real-time protection, ... MICROSOFT VULNERABILITY SUMMARY ... Meteor FTP Server USER Memory Corruption Vulnerability ... MDaemon SMTP Server Null Password Authentication Vulnerabili... ...
      (Focus-Microsoft)
    • SecurityFocus Microsoft Newsletter #69
      ... LANguard Security Event Log Monitor: ... MICROSOFT VULNERABILITY SUMMARY ... BrowseFTP Client Buffer Overflow Vulnerability ... Michael Lamont Savant Web Server Long Request DoS Vulnerability ...
      (Focus-Microsoft)
    • Re: Risk metrics
      ... security management life cycle. ... more objective snapshot of a company's risk posture. ... > traditional risk metrics in pen-tests cannot be ... >> vulnerability works, and if an exploit is in the ...
      (Pen-Test)