Abyss Web Server HTTP GET Request Directory Contents Disclosure Vulnerability

Bugtraq ID:	5345
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2002-1078
Remote:	Yes
Local:	No
Published:	Jul 29 2002 12:00AM
Updated:	Jul 11 2009 02:56PM
Credit:	Discovery credited to Securiteinfo.com <[email protected]>.
Vulnerable:	Aprelium Technologies Abyss Web Server 1.0.3
Not Vulnerable:

Abyss Web Server HTTP GET Request Directory Contents Disclosure Vulnerability

A vulnerability has been reported for Abyss Web Server 1.0.3 running on a Microsoft Windows platform. It is possible for an attacker to make a request such that the contents of the web server root directory are revealed.

The vulnerability occurs due to the manner in which excessive '/' characters are handled in web requests. When a malformed GET command is received by Abyss Web Server, it will return an error page containing the directory listing of the specified directory.

Abyss Web Server HTTP GET Request Directory Contents Disclosure Vulnerability

This issue may be exploited with a web browser.

Abyss Web Server HTTP GET Request Directory Contents Disclosure Vulnerability

Solution:
The vendor has released a newer version of the software:


Aprelium Technologies Abyss Web Server 1.0.3

• Aprelium Technologies abws107.exe
  http://www.aprelium.com/data/abws107.exe

Abyss Web Server HTTP GET Request Directory Contents Disclosure Vulnerability

References:

• Abyss Web Server Homepage (Aprelium Technologies)