lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Mon, 3 May 2004 12:48:02 +0200 From: <oliver@...yhat.de> To: <bugtraq@...urityfocus.com> Subject: Multible Vulnerabilites in Aldos Webserver Multible Vulnerabilites in Aldos Webserver ========================================== Aldo's Web Server is a super-compact Web service daemon that not only let you share easily your files, it also acts as a Advertisment or site blocker. Version: ======== 1.5 on Windows Platform Vulnerabilities: ================ 1) Physical Path Disclosure Connecting to Aweb via Telnet/Netcat, and entering any character will lead to an output similar to this: "Oliver_karow||D:\webserverMAI\aweb\" whereby oliver_karow is the user which runs the webserver process. 2) Directory Traversal Connecting to Aweb via Telnet/Netcat, and requesting a file like "GET /../../../boot.ini HTTP/1.0" enables an attacker to get access to files outside of the webroot folder. Vendor: ======= www.aldostools.com Vendor Status: ============== Informed since 30.04.2004 - no responce Discovered: =========== www.oliverkarow.de - 30.04.2004 www.oliverkarow.de/research/AldosWebserverMultipleVulns.txt
Powered by blists - more mailing lists