Apache HTTP Server Windows Share PHP File Extension Mapping Information Disclosure Vulnerability

Bugtraq ID:	26939
Class:	Environment Error
CVE:	CVE-2007-6514
Remote:	Yes
Local:	No
Published:	Dec 19 2007 12:00AM
Updated:	May 07 2015 05:34PM
Credit:	Maciej G�?�?�siorowski discovered this issue.
Vulnerable:	Apache Apache 2.2.6
Not Vulnerable:

Apache HTTP Server Windows Share PHP File Extension Mapping Information Disclosure Vulnerability

Apache is prone to an information-disclosure vulnerability.

This issue occurs because Apache fails to properly associate file extensions with the correct engines when handling specially crafted requests for files on Windows SMB shares.

Attackers can leverage this issue to view arbitrary script files as plain text. Potentially sensitive information may be present in the script code. Information harvested could aid in further attacks.

This issue affects Apache 2.2.6 when serving PHP files from a Windows SMB share; other versions may also be affected.

NOTE: This issue may also occur when handling other filename extensions that use AddType directives to associate scripts or executables (e.g. '.cgi\', '.py\', '.rb\', etc.).

Apache HTTP Server Windows Share PHP File Extension Mapping Information Disclosure Vulnerability

An attacker can exploit this issue via a browser.

The following proof-of-concept URI is available:

http://www.example.com/winshare/info.php\

Apache HTTP Server Windows Share PHP File Extension Mapping Information Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Apache HTTP Server Windows Share PHP File Extension Mapping Information Disclosure Vulnerability

References:

• Apache Homepage (Apache Software Foundation)
  
• smbfs and apache+php source code disclosure (Maciej G�?�?�siorowsk )