SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Web Server/CGI)  >   TheServer Vendors:   Fastlink Software
Fastlink Software 'TheServer' Web Server Access Bug May Let Remote Users View Log File Access Passwords
SecurityTracker Alert ID:  1004799
SecurityTracker URL:  http://securitytracker.com/id/1004799
CVE Reference:   CVE-2002-2389   (Links to External Site)
Updated:  Jun 3 2008
Original Entry Date:  Jul 18 2002
Impact:   Disclosure of authentication information
Exploit Included:  Yes  

Description:   A vulnerability was reported in 'TheServer' web server from Fastlink Software. The server stores passwords in unencrypted form in a configuration file that may be accessible to remote users and is accessible to local users.

Vapid Labs reported that 'TheServer' stores the password for log file accesss in clear text in the 'server.ini' file. By default, this file is located in the web server's root directory. A local or remote user could gain to the server.ini file and determine the password.

Impact:   A local user can obtain passwords for accessing the log file. A remote user may also be able to access this file.
Solution:   No solution was available at the time of this entry.
Vendor URL:  www.fastlinksoftware.com/ (Links to External Site)
Cause:   Access control error
Underlying OS:  Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  [Full-Disclosure] TheServer cleartext password sillyness.



				Vapid Labs
			       Security Note

A quick note on Fastlink Software's TheServer http server.  I was not
going to write this up since it is a silly problem but this server is
listed in the netcraft survey so people are using it.  TheServer is a very
small and simple webserver for the Windows platform it consists of a
single executable and configuration file.


Problem: TheServer stores the password for log file accesss in cleartext.
This password is stored in the server.ini file.  Which by default resides
in the servers root directory.  This is a VERY simple webserver for
Windows 98/95 if the server is setup to log, then the password is also
sent to the logfile when accessing the server logs remotely.  The risk is
you can have someone else parsing your weblogs that you never intended.

Vendor:
http://www.fastlinksoftware.com/

Netcraft Survey:
http://www.netcraft.com/Survey/servers.html

Larry Cashdollar
Vapid Labs
http://vapid.ath.cx


_______________________________________________
Full-Disclosure - We believe in it.
Full-Disclosure@lists.netsys.com
http://lists.netsys.com/mailman/listinfo/full-disclosure


 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC