Guido Frassetto SEDUM HTTP Server Directory Traversal Vulnerability

Bugtraq ID:	2335
Class:	Input Validation Error
CVE:	CVE-2001-0199
Remote:	Yes
Local:	Yes
Published:	Feb 04 2001 12:00AM
Updated:	Jul 11 2009 04:46AM
Credit:	Discovered and posted to Bugtraq on Feb 4, 2001 by Joe Testa <[email protected]>.
Vulnerable:	Guido Frassetto SEDUM HTTP Server 2.0 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0
Not Vulnerable:

Guido Frassetto SEDUM HTTP Server Directory Traversal Vulnerability

A remote user could gain read access to known files outside of the root directory in a SEDUM HTTP Server. Requesting a specially crafted URL composed of '../' or '.../' sequences will disclose the requested file.

Guido Frassetto SEDUM HTTP Server Directory Traversal Vulnerability

The following example has been provided by Joe Testa <[email protected]>:

http://target/../[file outside web root]

http://target/.../[file outside web root]

Guido Frassetto SEDUM HTTP Server Directory Traversal Vulnerability

Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Guido Frassetto SEDUM HTTP Server Directory Traversal Vulnerability

References:

• SEDUM HTTP Server Homepage (Guido Frassetto)
  
• SEDUM HTTP Server Information (ZDNet)