FAQManager.CGI NULL Character Arbitrary File Disclosure Vulnerability

Bugtraq ID:	3810
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 07 2002 12:00AM
Updated:	Jan 07 2002 12:00AM
Credit:	This vulnerability was submitted to BugTraq on January 7th, 2001 by Nu Omega Tau <[email protected]>.
Vulnerable:	FAQManager FAQManager.cgi 2.2.5 - Apache Apache 1.3.22 - Apache Apache 1.3.20 - Apache Apache 1.3.20 - Apache Apache 1.3.19 - Apache Apache 1.3.19 - Apache Apache 1.3.18 - Apache Apache 1.3.18 - Apache Apache 1.3.17 - Apache Apache 1.3.17 - Apache Apache 1.3.16 - Apache Apache 1.3.15 - Apache Apache 1.3.14 - Apache Apache 1.3.14 FAQManager FAQManager.cgi 2.2.4 - Apache Apache 1.3.22 - Apache Apache 1.3.20 - Apache Apache 1.3.20 - Apache Apache 1.3.19 - Apache Apache 1.3.19 - Apache Apache 1.3.18 - Apache Apache 1.3.18 - Apache Apache 1.3.17 - Apache Apache 1.3.17 - Apache Apache 1.3.16 - Apache Apache 1.3.15 - Apache Apache 1.3.14 - Apache Apache 1.3.14 FAQManager FAQManager.cgi 2.2.3 - Apache Apache 1.3.22 - Apache Apache 1.3.20 - Apache Apache 1.3.20 - Apache Apache 1.3.19 - Apache Apache 1.3.19 - Apache Apache 1.3.18 - Apache Apache 1.3.18 - Apache Apache 1.3.17 - Apache Apache 1.3.17 - Apache Apache 1.3.16 - Apache Apache 1.3.15 - Apache Apache 1.3.14 - Apache Apache 1.3.14 FAQManager FAQManager.cgi 2.2.2 - Apache Apache 1.3.22 - Apache Apache 1.3.20 - Apache Apache 1.3.20 - Apache Apache 1.3.19 - Apache Apache 1.3.19 - Apache Apache 1.3.18 - Apache Apache 1.3.18 - Apache Apache 1.3.17 - Apache Apache 1.3.17 - Apache Apache 1.3.16 - Apache Apache 1.3.15 - Apache Apache 1.3.14 - Apache Apache 1.3.14 FAQManager FAQManager.cgi 2.2.1 - Apache Apache 1.3.22 - Apache Apache 1.3.20 - Apache Apache 1.3.20 - Apache Apache 1.3.19 - Apache Apache 1.3.19 - Apache Apache 1.3.18 - Apache Apache 1.3.18 - Apache Apache 1.3.17 - Apache Apache 1.3.17 - Apache Apache 1.3.16 - Apache Apache 1.3.15 - Apache Apache 1.3.14 - Apache Apache 1.3.14 FAQManager FAQManager.cgi 2.2 - Apache Apache 1.3.22 - Apache Apache 1.3.20 - Apache Apache 1.3.20 - Apache Apache 1.3.19 - Apache Apache 1.3.19 - Apache Apache 1.3.18 - Apache Apache 1.3.18 - Apache Apache 1.3.17 - Apache Apache 1.3.17 - Apache Apache 1.3.16 - Apache Apache 1.3.15 - Apache Apache 1.3.14 - Apache Apache 1.3.14 FAQManager FAQManager.cgi 2.1.2 - Apache Apache 1.3.22 - Apache Apache 1.3.20 - Apache Apache 1.3.20 - Apache Apache 1.3.19 - Apache Apache 1.3.19 - Apache Apache 1.3.18 - Apache Apache 1.3.18 - Apache Apache 1.3.17 - Apache Apache 1.3.17 - Apache Apache 1.3.16 - Apache Apache 1.3.15 - Apache Apache 1.3.14 - Apache Apache 1.3.14 FAQManager FAQManager.cgi 2.1.1 - Apache Apache 1.3.22 - Apache Apache 1.3.20 - Apache Apache 1.3.20 - Apache Apache 1.3.19 - Apache Apache 1.3.19 - Apache Apache 1.3.18 - Apache Apache 1.3.18 - Apache Apache 1.3.17 - Apache Apache 1.3.17 - Apache Apache 1.3.16 - Apache Apache 1.3.15 - Apache Apache 1.3.14 - Apache Apache 1.3.14 FAQManager FAQManager.cgi 2.1 - Apache Apache 1.3.22 - Apache Apache 1.3.20 - Apache Apache 1.3.20 - Apache Apache 1.3.19 - Apache Apache 1.3.19 - Apache Apache 1.3.18 - Apache Apache 1.3.18 - Apache Apache 1.3.17 - Apache Apache 1.3.17 - Apache Apache 1.3.16 - Apache Apache 1.3.15 - Apache Apache 1.3.14 - Apache Apache 1.3.14 FAQManager FAQManager.cgi 2.0 - Apache Apache 1.3.22 - Apache Apache 1.3.20 - Apache Apache 1.3.20 - Apache Apache 1.3.19 - Apache Apache 1.3.19 - Apache Apache 1.3.18 - Apache Apache 1.3.18 - Apache Apache 1.3.17 - Apache Apache 1.3.17 - Apache Apache 1.3.16 - Apache Apache 1.3.15 - Apache Apache 1.3.14 - Apache Apache 1.3.14
Not Vulnerable:	FAQManager FAQManager.cgi 2.2.6 - Apache Apache 1.3.22 - Apache Apache 1.3.20 - Apache Apache 1.3.20 - Apache Apache 1.3.19 - Apache Apache 1.3.19 - Apache Apache 1.3.18 - Apache Apache 1.3.18 - Apache Apache 1.3.17 - Apache Apache 1.3.17 - Apache Apache 1.3.16 - Apache Apache 1.3.15 - Apache Apache 1.3.14 - Apache Apache 1.3.14

FAQManager.CGI NULL Character Arbitrary File Disclosure Vulnerability

FAQManager.cgi is a Perl script for maintaining a FAQ (Frequently Asked Questions) via a web interface. It will run on most Unix/Linux and Microsoft Windows platforms.

FAQManager does not properly filter certain types of input from incoming web requests. It is possible to append a NULL character (%00) to the of a web request and display the contents of an arbitrary web-readable file.

FAQManager.CGI NULL Character Arbitrary File Disclosure Vulnerability

This issue may be exploited with a web browser.

FAQManager.CGI NULL Character Arbitrary File Disclosure Vulnerability

Solution:
The vendor has addressed this issue in v2.2.6. However, it has been reported that the vendor's fix only partially addresses the issue at hand.


FAQManager FAQManager.cgi 2.0

• FAQManager FAQmanager_2.2.6.zip
  http://www.fourteenminutes.com/code/faqmanager/FAQmanager_2.2.6.zip

FAQManager FAQManager.cgi 2.1

• FAQManager FAQmanager_2.2.6.zip
  http://www.fourteenminutes.com/code/faqmanager/FAQmanager_2.2.6.zip

FAQManager FAQManager.cgi 2.1.1

• FAQManager FAQmanager_2.2.6.zip
  http://www.fourteenminutes.com/code/faqmanager/FAQmanager_2.2.6.zip

FAQManager FAQManager.cgi 2.1.2

• FAQManager FAQmanager_2.2.6.zip
  http://www.fourteenminutes.com/code/faqmanager/FAQmanager_2.2.6.zip

FAQManager FAQManager.cgi 2.2

• FAQManager FAQmanager_2.2.6.zip
  http://www.fourteenminutes.com/code/faqmanager/FAQmanager_2.2.6.zip

FAQManager FAQManager.cgi 2.2.1

• FAQManager FAQmanager_2.2.6.zip
  http://www.fourteenminutes.com/code/faqmanager/FAQmanager_2.2.6.zip

FAQManager FAQManager.cgi 2.2.2

• FAQManager FAQmanager_2.2.6.zip
  http://www.fourteenminutes.com/code/faqmanager/FAQmanager_2.2.6.zip

FAQManager FAQManager.cgi 2.2.3

• FAQManager FAQmanager_2.2.6.zip
  http://www.fourteenminutes.com/code/faqmanager/FAQmanager_2.2.6.zip

FAQManager FAQManager.cgi 2.2.4

• FAQManager FAQmanager_2.2.6.zip
  http://www.fourteenminutes.com/code/faqmanager/FAQmanager_2.2.6.zip

FAQManager FAQManager.cgi 2.2.5

• FAQManager FAQmanager_2.2.6.zip
  http://www.fourteenminutes.com/code/faqmanager/FAQmanager_2.2.6.zip

FAQManager.CGI NULL Character Arbitrary File Disclosure Vulnerability

References:

• FAQManager Homepage (FAQManager)