Summit Computer Networks Lil' HTTP Server Directory Disclosure Vulnerability

Bugtraq ID:	4153
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 21 2002 12:00AM
Updated:	Feb 21 2002 12:00AM
Credit:	Discovered by Tamer Sahin <[email protected]>.
Vulnerable:	Summit Computer Networks Lil'HTTP 2.1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0
Not Vulnerable:	Summit Computer Networks Lil'HTTP 2.2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0

Summit Computer Networks Lil' HTTP Server Directory Disclosure Vulnerability

Reportedly, it is possible for a remote user to reveal the contents of secure directories residing on a Lil' HTTP host.

Submitting a specially crafted request for a known secure directory, is reported to return the contents of the directory to the user.

Summit Computer Networks Lil' HTTP Server Directory Disclosure Vulnerability

No exploit code required.

Summit Computer Networks Lil' HTTP Server Directory Disclosure Vulnerability

Solution:
This issue has been addressed in version 2.2:


Summit Computer Networks Lil'HTTP 2.1

• Summit Computer Networks lilhtv22.zip
  http://www.summitcn.com/lilhtv22.zip

Summit Computer Networks Lil' HTTP Server Directory Disclosure Vulnerability

References:

• Lil' HTTP Homepage (Summit Computer Networks)