full-disclosure - IFH-ADV-31337 File Source disclosure vulnerability in all web servers.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

From: infohacking at hushmail.com (Hugo Vazquez Carapez)
Subject: IFH-ADV-31337 File Source disclosure vulnerability in all web servers.

File Source disclosure vulnerability in all web servers.

Infohacking Security Advisory 04.16.04
www.infohacking.com
Jun 16, 2004

I. BACKGROUND

We discovered a very dangerous file source disclosure vulnerability in
all
webservers. This issue can be exploited using Microsoft Internet Explorer
and probably other browsers.

II. DESCRIPTION

Remote explotation of this issue can be achived by clicking with the
right button into the website and selecting the "view source code" option.
This option will display the contents of the html code.

For more leet explotation is also possible using lynx --source http://vulnerable.site/file.html

III. ANALYSIS

Successful exploitation allows an attacker to gain very very very sensible
information of the website.

IV. DETECTION

Infohacking has confirmed that all webservers are vulnerable to this
problem. Sites like microsoft, securityfocus, hack.co.za and others are
vulnerable too!

V. WORKAROUNDS

No work.. indeed.

VI. CVE INFORMATION

This is an 0day bug... so still no bid and CVE.

VII. DISCLOSURE TIMELINE

02/18/04 Hugo notified the bug to abuse@....255.255.255
03/11/04 Initial vendor notification - no response
03/30/04 Secondary vendor notification - no response
05/20/04 We hack iberia.com
06/17/04 Public Disclosure

VIII. CREDIT

Hugo Vázquez Carapez http://www.infohacking.com/dirhugo.gif

Get pwned by script kiddies?
Call us, we can hack you again.

IX. LEGAL NOTICES

Copyright (c) 2004 INFOHACKING, Inc.

Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without the express
written consent of INFOHACKING. If you wish to reprint the whole or any

part of this alert in any other medium other than electronically, please

email info@...ohacking.com for permission.

Disclaimer: Infohacking is pretty whitehat and lame. If you are a part
of the blackhat communitie, please hack and remove us from the net

Concerned about your privacy? Follow this link to get
secure FREE email: http://www.hushmail.com/?l=2

Free, ultra-private instant messaging with Hush Messenger
http://www.hushmail.com/services.php?subloc=messenger&l=434

Promote security and make money with the Hushmail Affiliate Program: 
http://www.hushmail.com/about.php?subloc=affiliate&l=427