Bannermatic World Readable Data Files Information Disclosure Vulnerability

Bugtraq ID:	4738
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	May 14 2002 12:00AM
Updated:	May 14 2002 12:00AM
Credit:	Discovered by frog frog <[email protected]>.
Vulnerable:	Joe DePasquale Bannermatic 3.0 Joe DePasquale Bannermatic 2.0 Joe DePasquale Bannermatic 1.0
Not Vulnerable:

Bannermatic World Readable Data Files Information Disclosure Vulnerability

Bannermatic is a banner ad rotation system maintained by Joe DePasquale of GetCruising.

Bannermatic is subject to an information disclosure issue. Reportedly, ban.log, ban.bak, ban.dat and banmat.pwd are world readable and all contain sensitive data.

Obtaining the information contained within either file, could result in the attacker launching further attacks against the host.

Bannermatic World Readable Data Files Information Disclosure Vulnerability

No exploit code is required.

Bannermatic World Readable Data Files Information Disclosure Vulnerability

Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Bannermatic World Readable Data Files Information Disclosure Vulnerability

References:

• Bannermatic Homepage (GetCruising)
  
• Security holes : Pseudo-Frame, PG, KvPoll, Phorum, BanMat (frog frog )