SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service
Report a Bug
Report a vulnerability that you have found to SecurityTracker
bugs
@
securitytracker.com






Category:   Application (Web Server/CGI)  >   GoAhead Web Server Vendors:   GoAhead Software
GoAhead WebServer Discloses Script Source Code to Remote Users
SecurityTracker Alert ID:  1005820
SecurityTracker URL:  http://securitytracker.com/id/1005820
CVE Reference:   CVE-2002-1603   (Links to External Site)
Updated:  Jun 8 2008
Original Entry Date:  Dec 17 2002
Impact:   Disclosure of system information
Exploit Included:  Yes  
Version(s): 2.1, 2.1.2
Description:   An information disclosure vulnerability was reported in the GoAhead WebServer. A remote user can view the source code of scripts on the web server.

ProCheckUp issued a security advisory warning that a remote user can submit a specially crafted, malformed HTTP URL ending in various characters (e.g., '\', '/' ,'%20', '%00') to cause the server to disclose script source code.

Some demonstration exploit URLs are provided:

http://webserver/treeapp.asp\
http://webserver/treeapp.asp/
http://webserver/treeapp.app%20
http://webserver/treeapp.app%00

The vendor has reportedly been notified.

ProCheckUp also noted that the server is still vulnerable to the previously reported denial of service flaw when a remote user requests COM2 or AUX DOS devices.

Impact:   A remote user can view script source code on the server.
Solution:   No solution was available at the time of this entry.
Vendor URL:  www.goahead.com/webserver/webserver.htm (Links to External Site)
Cause:   Input validation error
Underlying OS:   Windows (NT), Windows (2000)

Message History:   This archive entry has one or more follow-up message(s) listed below.
Dec 17 2003 (Vendor Issues Fix) GoAhead Web Server Discloses Script Source Code to Remote Users
A fix is available.



 Source Message Contents

Date:  Tue, 17 Dec 2002 09:57:20 -0500
Subject:  GoAhead Web Server Bugs


http://www.procheckup.com/security_info/vuln_pr0213.html

ProCheckUp issued a security advisory warning of a vulnerability in the GoAhead Web
Server.  According to the report, version 2.12, 2.1, and prior versions may disclose
source code to remote users.

ProCheckUp indicates that this vulnerability has been documented by CERT in VU#975041 (but
has not yet been published by CERT).

Microsoft Windows NT4 SP6A and Windows 2000 SP2+hotfixes are the affected operating system
platforms.

It is reported that a remote user can submit a specially crafted, malformed HTTP URL
edning in various characters (e.g., '\', '/' ,'%20', '%00') to cause the server to
disclose script source code.

Some demonstration exploit URLs were provided:

http://webserver/treeapp.asp\
http://webserver/treeapp.asp/
http://webserver/treeapp.app%20
http://webserver/treeapp.app%00

The vendor has reportedly been notified.

ProCheckUp also noted that the server is still vulnerable to the previously reported
denial of service flaw when a remote user requests COM2 or AUX DOS devices.



 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

Copyright 2014, SecurityGlobal.net LLC