Debian Linux httpd Vulnerability
BID:318
Info
Debian Linux httpd Vulnerability
| Bugtraq ID: | 318 |
| Class: | Configuration Error |
| CVE: | |
| Remote: | Yes |
| Local: | Yes |
| Published: | Jan 17 1999 12:00AM |
| Updated: | Jan 17 1999 12:00AM |
| Credit: | |
| Vulnerable: |
Debian Linux 2.1 |
| Not Vulnerable: | |
Discussion
Debian Linux httpd Vulnerability
The Debian GNU/Linux 2.1 apache package by default allows anyone to view /usr/doc via the web, remotely. This is because srm.conf is preconfigured with the line:
Alias /doc/ /usr/doc/
Boa is also preconfigured this way.
The Debian GNU/Linux 2.1 apache package by default allows anyone to view /usr/doc via the web, remotely. This is because srm.conf is preconfigured with the line:
Alias /doc/ /usr/doc/
Boa is also preconfigured this way.
Exploit / POC
Debian Linux httpd Vulnerability
lynx http://some.host/doc
This will provide you with all of the information in /usr/doc, which could be used to find vulnerable software on the remote machine.
lynx http://some.host/doc
This will provide you with all of the information in /usr/doc, which could be used to find vulnerable software on the remote machine.
Solution / Fix
Debian Linux httpd Vulnerability
Solution:
The following addition to /etc/apache/access.conf will restrict access:
<Directory /usr/doc>
AllowOverride None
order deny,allow
deny from all
allow from localhost
</Directory>
Solution:
The following addition to /etc/apache/access.conf will restrict access:
<Directory /usr/doc>
AllowOverride None
order deny,allow
deny from all
allow from localhost
</Directory>
References
Debian Linux httpd Vulnerability
References:
References: