SimpleServer WWW Directory Traversal Vulnerability

Bugtraq ID:	1508
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	Yes
Published:	Jul 26 2000 12:00AM
Updated:	Jul 26 2000 12:00AM
Credit:	Discovered by and posted to Bugtraq on July 26, 2000 by Foundstone Inc. <http://www.foundstone.com>.
Vulnerable:	AnalogX SimpleServer:WWW 1.0.6 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0
Not Vulnerable:	AnalogX SimpleServer:WWW 1.0.7 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0

SimpleServer WWW Directory Traversal Vulnerability

Requesting a specially formed url containing encoding (%2E) to SimpleServer 1.06 and possibley earlier versions, will enable a remote user to gain read access to known files above the SimpleServer directory.

SimpleServer WWW Directory Traversal Vulnerability

http://target/%2E%2E/filename

SimpleServer WWW Directory Traversal Vulnerability

Solution:
Upgrade to SimpleServer:WWW 1.07