ION Script Remote File Disclosure Vulnerability
BID:6091
Info
ION Script Remote File Disclosure Vulnerability
| Bugtraq ID: | 6091 |
| Class: | Input Validation Error |
| CVE: |
CVE-2002-1559 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 01 2002 12:00AM |
| Updated: | Jul 11 2009 06:06PM |
| Credit: | Discovery of this vulnerability credited to Zero X. |
| Vulnerable: |
ION Script 1.4 |
| Not Vulnerable: | |
Discussion
ION Script Remote File Disclosure Vulnerability
A vulnerability has been discovered in ION Script.
By sending a malicious HTTP request to a webserver running the vulnerable ION Script package, it is possible for a remote attacker to disclose arbitrary webserver readable files. As webservers are often run with high privileges, it may be possible to disclose sensitive system files.
Exploiting this issue may allow an attacker to gain information required to launch further attacks against the target system.
ION Script for UNIX has also been confirmed vulnerable to this issue.
It is not yet known which ION Script packages are vulnerable to this issue.
A vulnerability has been discovered in ION Script.
By sending a malicious HTTP request to a webserver running the vulnerable ION Script package, it is possible for a remote attacker to disclose arbitrary webserver readable files. As webservers are often run with high privileges, it may be possible to disclose sensitive system files.
Exploiting this issue may allow an attacker to gain information required to launch further attacks against the target system.
ION Script for UNIX has also been confirmed vulnerable to this issue.
It is not yet known which ION Script packages are vulnerable to this issue.
Exploit / POC
ION Script Remote File Disclosure Vulnerability
This issue can be exploited using a web browser. The following examples were submitted:
http://www.example.com/cgi-bin/ion-p.exe?page=c:\winnt\repair\sam
http://www.example.com/cgi-bin/ion-p?page=../../../../../etc/hosts
This issue can be exploited using a web browser. The following examples were submitted:
http://www.example.com/cgi-bin/ion-p.exe?page=c:\winnt\repair\sam
http://www.example.com/cgi-bin/ion-p?page=../../../../../etc/hosts
Solution / Fix
ION Script Remote File Disclosure Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
ION Script Remote File Disclosure Vulnerability
References:
References:
- ION Script Product Page (www.rsinc.com)
- ion-p.exe allows Remote File Retrieving ("Zero-X www.lobnan.de Team"
- Re: ion-p.exe allows Remote File Retrieving (Stuart Moore