Easy File Sharing Web Server Access Control Bypass Vulnerability

Bugtraq ID:	11034
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 24 2004 12:00AM
Updated:	Aug 24 2004 12:00AM
Credit:	Discovery of this vulnerability is credited to James Bercegay of the GulfTech Security Research Team.
Vulnerable:	EFS Software Easy File Sharing Web Server 1.25 EFS Software Easy File Sharing Web Server 1.2
Not Vulnerable:

Easy File Sharing Web Server Access Control Bypass Vulnerability

Easy File Sharing Web Server is reported prone to an access control bypass vulnerability.

It is reportedly possible for a remote attacker to gain read access to the filesystem on the underlying computer by making a request for the name of a virtual folder on the Web Server.

Information harvested by exploiting this vulnerability may be used to aid in further attacks launched against the vulnerable computer.

Easy File Sharing Web Server Access Control Bypass Vulnerability

There is no exploit required.

Easy File Sharing Web Server Access Control Bypass Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Easy File Sharing Web Server Access Control Bypass Vulnerability

References:

• Easy File Sharing Webserver v1.25 Vulnerabilities (GulfTech)
  
• Easy File Sharing Web Server (EFS Software)
  
• Easy File Sharing Webserver v1.25 Vulnerabilities ("GulfTech Security" )