Gattaca Server 2003 Multiple Path Disclosure Vulnerabilities
BID:10729
Info
Gattaca Server 2003 Multiple Path Disclosure Vulnerabilities
| Bugtraq ID: | 10729 |
| Class: | Failure to Handle Exceptional Conditions |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 15 2004 12:00AM |
| Updated: | Jul 15 2004 12:00AM |
| Credit: | dr_insane <[email protected]> discovered these vulnerabilities. |
| Vulnerable: |
GeeOS Team Gattaca Server 2003 1.1.10 .0 |
| Not Vulnerable: | |
Discussion
Gattaca Server 2003 Multiple Path Disclosure Vulnerabilities
It is reported that Gattaca Server 2003 contains multiple path disclosure vulnerabilities.
By sending HTTP requests to Gattaca's web server, it is reportedly possible to cause the application to return error pages that contain the full installation path of the application and the web document root path.
These vulnerabilities could be used by an attacker to aid them in further attacks against the server.
Version 1.1.10.0 is reported vulnerable. Prior versions may also contain these vulnerabilities as well.
It is reported that Gattaca Server 2003 contains multiple path disclosure vulnerabilities.
By sending HTTP requests to Gattaca's web server, it is reportedly possible to cause the application to return error pages that contain the full installation path of the application and the web document root path.
These vulnerabilities could be used by an attacker to aid them in further attacks against the server.
Version 1.1.10.0 is reported vulnerable. Prior versions may also contain these vulnerabilities as well.
Exploit / POC
Gattaca Server 2003 Multiple Path Disclosure Vulnerabilities
No exploit is required.
An example URI that may return the installation path:
http://www.example.com/%00
An example URI that may return the web document root:
http://www.example.com/web.tmpl?HELPID=8000&TEMPLATE=skins//water&LANGUAGE=[whatever]
No exploit is required.
An example URI that may return the installation path:
http://www.example.com/%00
An example URI that may return the web document root:
http://www.example.com/web.tmpl?HELPID=8000&TEMPLATE=skins//water&LANGUAGE=[whatever]
Solution / Fix
Gattaca Server 2003 Multiple Path Disclosure Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Gattaca Server 2003 Multiple Path Disclosure Vulnerabilities
References:
References:
- Gattaca Server (GeeOS Team software)
- Gattaca Server 2003 (1.1.10.0) (dr_insane)