Apache CGI Script Source Code Information Disclosure Vulnerability

Bugtraq ID:	19447
Class:	Environment Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 09 2006 12:00AM
Updated:	Aug 10 2006 08:05PM
Credit:	Susam Pal is credited with the discovery of this vulnerability.
Vulnerable:	Apache Apache 2.2.2
Not Vulnerable:

Apache CGI Script Source Code Information Disclosure Vulnerability

Apache is prone to an information-disclosure vulnerability because it fails to properly handle exceptional conditions.

An attacker can exploit this issue to retrieve script source code. Information obtained may aid in further attacks.

Versions 2.2.2 for Microsoft Windows is vulnerable to this issue; other versions may also be affected.

Apache CGI Script Source Code Information Disclosure Vulnerability

Attackers can exploit this issue via a web client.

The following proof-of-concept URI is available:

• /data/vulnerabilities/exploits/apache-aug9-2006.html

Apache CGI Script Source Code Information Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].

Apache CGI Script Source Code Information Disclosure Vulnerability

References:

• Apache Homepage (Apache Software Foundation)
  
• CGI Script Source Code Disclosure Vulnerability in Apache for Windows (Susam Pal)