• News
• Infocus
• Foundations
• Microsoft
• Unix
• IDS
• Incidents
• Virus
• Pen-Test
• Firewalls
• Columnists
• Mailing Lists
• Newsletters
• Bugtraq
• Focus on IDS
• Focus on Linux
• Focus on Microsoft
• Forensics
• Pen-test
• Security Basics
• Vuln Dev
• Vulnerabilities
• Jobs
• Job Opportunities
• Resumes
• Job Seekers
• Employers
• Tools
• RSS
• News
• Vulns
• Security Research

• info
• discussion
• exploit
• solution
• references

Cherokee HTTPD Directory Traversal Vulnerability

Cherokee is a compact web server which provides fast delivery of web content. It is freely available and distributed under the GPL. It runs on Linux and other Unix systems.

Cherokee is prone to directory traversal attacks. By appending '../' sequences to a web request, it is possible for an attacker to browse the filesystem of the host.

Furthermore, another issue is known to exist in Cherokee which increases the impact of this vulnerability dramatically. BugTraq ID 3771, "Cherokee HTTPD Insecure Privilege Release Vulnerability" describes a problem in which Cherokee web server fails to drop root privileges after binding to port 80. The implication is that an attacker may browse any file on the system, as the web server is running with root privileges.