lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <200406161959.i5GJxb1M026236@mailserver2.hushmail.com>
From: infohacking at hushmail.com (Hugo Vazquez Carapez)
Subject: IFH-ADV-31337 File Source disclosure vulnerability in all web servers.

File Source disclosure vulnerability in all web servers.


Infohacking Security Advisory 04.16.04
www.infohacking.com
Jun 16, 2004


I. BACKGROUND

We discovered a very dangerous file source disclosure vulnerability in
all
webservers. This issue can be exploited using Microsoft Internet Explorer
and probably other browsers.


II. DESCRIPTION


Remote explotation of this issue can be achived by clicking with the
right button into the website and selecting the "view source code" option.
This option will display the contents of the html code.


For more leet explotation is also possible using lynx --source http://vulnerable.site/file.html


III. ANALYSIS


Successful exploitation allows an attacker to gain very very very sensible
information of the website.



IV. DETECTION


Infohacking has confirmed that all webservers are vulnerable to this
problem. Sites like microsoft, securityfocus, hack.co.za and others are
vulnerable too!



V. WORKAROUNDS


No work.. indeed.


VI. CVE INFORMATION


This is an 0day bug... so still no bid and CVE.


VII. DISCLOSURE TIMELINE


02/18/04 Hugo notified the bug to abuse@....255.255.255
03/11/04 Initial vendor notification - no response
03/30/04 Secondary vendor notification - no response
05/20/04 We hack iberia.com
06/17/04 Public Disclosure


VIII. CREDIT

Hugo Vázquez Carapez http://www.infohacking.com/dirhugo.gif


Get pwned by script kiddies?
Call us, we can hack you again.


IX. LEGAL NOTICES


Copyright (c) 2004 INFOHACKING, Inc.


Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without the express
written consent of INFOHACKING. If you wish to reprint the whole or any

part of this alert in any other medium other than electronically, please

email info@...ohacking.com for permission.


Disclaimer: Infohacking is pretty whitehat and lame. If you are a part
of the blackhat communitie, please hack and remove us from the net



Concerned about your privacy? Follow this link to get
secure FREE email: http://www.hushmail.com/?l=2

Free, ultra-private instant messaging with Hush Messenger
http://www.hushmail.com/services.php?subloc=messenger&l=434

Promote security and make money with the Hushmail Affiliate Program: 
http://www.hushmail.com/about.php?subloc=affiliate&l=427


Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ