04WebServer Multiple Remote Vulnerabilities

Bugtraq ID:	11652
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 10 2004 12:00AM
Updated:	Nov 10 2004 12:00AM
Credit:	Disclosure of these issues is credited to Tan Chew Keong.
Vulnerable:	04WebServer Web Server 1.42
Not Vulnerable:	04WebServer 04WebServer 1.5

04WebServer Multiple Remote Vulnerabilities

Multiple remote vulnerabilities reportedly affect 04WebServer. These issues are due to a failure of the application to properly sanitize user-supplied input.

An attacker may leverage these issues to carry out cross-site scripting attacks against any Web sites hosted on the affected server and to inject arbitrary characters into log files, potentially leading to corruption.

04WebServer Multiple Remote Vulnerabilities

No exploit is required to leverage these issues. The following proof of concepts have been provided:

To leverage the cross-site scripting issue:
http://www.example.com/<script>alert('XSS');</script>

To inject the log entry '[22;45;24] <192.168.1.3> (74,632) [?.?.?.?I?.?.?.?.?.] GET /hack' into the log file the following request is sufficient:
http://www.example.com/a%0a[22;45;24]%20<192.168.1.3>%20(74,632)%20[%90%b3%8f%ed%82%c9%8f%49%97%b9%82%b5%82%dc%82%b5%82%bd]%20GET%20/hack

04WebServer Multiple Remote Vulnerabilities

Solution:
The vendor has released 04WebServer 1.50 to address these issues.


04WebServer Web Server 1.42

• 04WebServer 04WebServer150.zip
  http://soft3304.net/04WebServer/Download/04WebServer150.zip

04WebServer Multiple Remote Vulnerabilities

References:

• 04WebServer Home Page (04WebServer)
  
• 04WebServer Three Vulnerabilities ("Jérôme" ATHIAS )
  
• Re: 04WebServer Three Vulnerabilities ()