Summit Computer Networks Lil' HTTP Server Directory Traversal Vulnerability

Bugtraq ID:	4576
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 21 2002 12:00AM
Updated:	Apr 21 2002 12:00AM
Credit:	Discovered by Matthew Murphy <[email protected]>.
Vulnerable:	Summit Computer Networks Lil'HTTP 2.2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 Summit Computer Networks Lil'HTTP 2.1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0
Not Vulnerable:

Summit Computer Networks Lil' HTTP Server Directory Traversal Vulnerability

Lil' HTTP server is a web server application for Windows environments and is maintained by Summit Computer Networks.

Reportedly, it is possible to traverse the directory structure of a host using '../' character sequences in web requests for known resources.

It should be noted that SecurityFocus has not been able to successfully reproduce this issue. Therefore, it is possible that the issue discussed in BID 4153 may be related to the issue discussed here.

Summit Computer Networks Lil' HTTP Server Directory Traversal Vulnerability

Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.