OSVDB ID: 859

Title: Apache HTTP Server Win32 Crafted Traversal Arbitrary File Access

Info

Disclosure
Aug 16, 2002

Discovery
Unknown

Dates

Exploit
Aug 16, 2002

Solution
Unknown

Description

 Apache Win32 contains a flaw that allows a remote attacker to access arbitrary files and execute arbitrary binaries outside of the web path. The issue is due to the server not properly sanitizing user input, specifically encoded traversal style attacks (../../) supplied via the URI.

Classification

 Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Confidentiality, Loss of Integrity
Exploit: Exploit Public
Disclosure: OSVDB Verified
OSVDB: Web Related

Solution

 Upgrade to version 2.0.40 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

Apache Software Foundation

Web Server (Win32)

 2.0.0x
2.0.1x
2.0.2x
2.0.30
2.0.31
2.0.32
2.0.33
2.0.34
2.0.35
2.0.36
2.0.37
2.0.38
2.0.39

References

Credit
  • Luigi Auriemma - aluigialtervista.org - http://aluigi.altervista.org


Direct URL: http://osvdb.org/859