Lil' HTTP Server Source Code Information Disclosure Vulnerability

Bugtraq ID:	48022
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	May 27 2011 12:00AM
Updated:	May 27 2011 12:00AM
Credit:	Treasure Priyamal
Vulnerable:	Summit Computer Networks Lil'HTTP 2.2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 Summit Computer Networks Lil'HTTP 2.1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 Summit Computer Networks Lil'HTTP 2.2C - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0
Not Vulnerable:

Lil' HTTP Server Source Code Information Disclosure Vulnerability

Lil' HTTP Server is prone to a vulnerability that lets attackers access source code files.

An attacker can exploit this vulnerability to retrieve certain files from the vulnerable computer in the context of the webserver process. Information obtained may aid in further attacks.

Lil' HTTP Server 2.2c and prior are vulnerable; other versions may also be affected.

Lil' HTTP Server Source Code Information Disclosure Vulnerability

Attackers can exploit this vulnerability via a browser.

The following exploit code is available:

• /data/vulnerabilities/exploits/48022.rb

Lil' HTTP Server Source Code Information Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Lil' HTTP Server Source Code Information Disclosure Vulnerability

References:

• Lil' HTTP Homepage (Summit Computer Networks)