mcNews Path Disclosure Vulnerability
BID:4772
Info
mcNews Path Disclosure Vulnerability
| Bugtraq ID: | 4772 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 17 2002 12:00AM |
| Updated: | May 17 2002 12:00AM |
| Credit: | Discovery of this issue is credited to frog frog <[email protected]>. |
| Vulnerable: |
McNews McNews 1.2 McNews McNews 1.1 a McNews McNews 1.1 McNews McNews 1.0 |
| Not Vulnerable: | |
Discussion
mcNews Path Disclosure Vulnerability
mcNews is a set of scripts for allowing users to post news stories on a webpage. It will run on most Linux and Unix variants as well as Microsoft Windows operating systems.
mcNews will disclose sensitive path information when a malformed web request is made.
This type of information may used be in further attacks against the host.
mcNews is a set of scripts for allowing users to post news stories on a webpage. It will run on most Linux and Unix variants as well as Microsoft Windows operating systems.
mcNews will disclose sensitive path information when a malformed web request is made.
This type of information may used be in further attacks against the host.
Exploit / POC
mcNews Path Disclosure Vulnerability
This issue may be exploited with a web browser.
This issue may be exploited with a web browser.
Solution / Fix
mcNews Path Disclosure Vulnerability
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
mcNews Path Disclosure Vulnerability
References:
References:
- mcNews Homepage (mcNews)
- Security holes : mcNews (frog frog