MRTG Configuration Generator Path Disclosure Vulnerability

Bugtraq ID:	4021
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 04 2002 12:00AM
Updated:	Feb 04 2002 12:00AM
Credit:	Reported to Bugtraq by Tamer Sahin <[email protected]>.
Vulnerable:	MRTG MRTGconfig 0.5.9
Not Vulnerable:

MRTG Configuration Generator Path Disclosure Vulnerability

MRTG Configuration Generator is a configuration file generator for devices being monitored on a network.

A vulnerability has been reported in mrtg.cgi that could allow a malicious user to view the full path to the web root.

Reportedly, if a user submits a HTTP request to a host containing unusual characters, the server will return an error page containing the path to the web root.

MRTG Configuration Generator Path Disclosure Vulnerability

No exploit code is required.

MRTG Configuration Generator Path Disclosure Vulnerability

Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

MRTG Configuration Generator Path Disclosure Vulnerability

References:

• MRTGconfig Homepage (MRTG Configuration Generator)