Red Hat Linux Apache Remote Username Enumeration Vulnerability
BID:3335
Info
Red Hat Linux Apache Remote Username Enumeration Vulnerability
| Bugtraq ID: | 3335 |
| Class: | Configuration Error |
| CVE: |
CVE-2001-1013 |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 12 2001 12:00AM |
| Updated: | Jul 11 2009 07:56AM |
| Credit: | Reported to bugtraq by Alexander A. Kelner <[email protected]> on September 12, 2001. |
| Vulnerable: |
Redhat Linux 7.0 |
| Not Vulnerable: | |
Discussion
Red Hat Linux Apache Remote Username Enumeration Vulnerability
Versions of Apache webserver shipping with Red Hat Linux 7.0 (and possibly other Apache distributions) install with a default misconfiguration which could allow remote users to determine whether a give username exists on the vulnerable system.
http://www.example.com/~<username>
When a remote user makes a request for a possible user's default home page, the server returns one of three responses:
In a case where <username> is a valid user account, and has been configured with a homepage, the server responds with the user's homepage.
When <username> exists on the system, but has not been assigned a homepage document, the server returns the message "You don't have permission to access /~username on this server."
However, if the tested username does not exist as an account on the system, the Apache server's response includes the message "The requested URL /~username was not found on this server."
Because the server responds differently in the latter two cases, a remote user can test and enumerate possible usernames. Properly exploited, this information could be used in further attacks on the vulnerable hos
Versions of Apache webserver shipping with Red Hat Linux 7.0 (and possibly other Apache distributions) install with a default misconfiguration which could allow remote users to determine whether a give username exists on the vulnerable system.
http://www.example.com/~<username>
When a remote user makes a request for a possible user's default home page, the server returns one of three responses:
In a case where <username> is a valid user account, and has been configured with a homepage, the server responds with the user's homepage.
When <username> exists on the system, but has not been assigned a homepage document, the server returns the message "You don't have permission to access /~username on this server."
However, if the tested username does not exist as an account on the system, the Apache server's response includes the message "The requested URL /~username was not found on this server."
Because the server responds differently in the latter two cases, a remote user can test and enumerate possible usernames. Properly exploited, this information could be used in further attacks on the vulnerable hos
Exploit / POC
Red Hat Linux Apache Remote Username Enumeration Vulnerability
apachex.php courtesy Gabriel A Maggiotti <[email protected]>. A new exploit program has been made available by m00 Security.
apachex.php courtesy Gabriel A Maggiotti <[email protected]>. A new exploit program has been made available by m00 Security.
Solution / Fix
Red Hat Linux Apache Remote Username Enumeration Vulnerability
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Red Hat Linux Apache Remote Username Enumeration Vulnerability
References:
References: