Deerfield WebSite Pro 8.3 Filename Source Disclosure Vulnerability

Bugtraq ID:	4783
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 20 2002 12:00AM
Updated:	May 20 2002 12:00AM
Credit:	Discovery of this issue is credited to Ory Segal <[email protected]>.
Vulnerable:	Deerfield.com WebSite 3.1.11 .0
Not Vulnerable:	Deerfield.com WebSite 3.1.13 .0

Deerfield WebSite Pro 8.3 Filename Source Disclosure Vulnerability

Deerfield WebSite Pro is a commercial webserver for Microsoft Windows operating systems.

Deerfield WebSite Pro is prone to a vulnerability which is the result of how requests for files using the 8.3 short filenames are handled.

In particular, this issue occurs when the software attempts to serve files with extensions which are at least four characters long (such as .shtml), but are requested using the 8.3 short filenames. The result is that the software will fail to call the proper handler for the extension.

An attacker may exploit this issue to disclose script source code.

Deerfield WebSite Pro 8.3 Filename Source Disclosure Vulnerability

This issue may be exploited with a web browser.

Deerfield WebSite Pro 8.3 Filename Source Disclosure Vulnerability

Solution:
The vendor has also released an upgrade which addresses this issue.


Deerfield.com WebSite 3.1.11 .0

• Deerfield.com Website Pro 3.1.13.0
  http://www.deerfield.com/download/website/

Deerfield WebSite Pro 8.3 Filename Source Disclosure Vulnerability

References:

• WebSite Pro Homepage (Deerfield)