WWWBoard Password Disclosure Vulnerability
BID:649
Info
WWWBoard Password Disclosure Vulnerability
| Bugtraq ID: | 649 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 16 1999 12:00AM |
| Updated: | Sep 16 1999 12:00AM |
| Credit: | This vulnerability was discovered by David Weins <[email protected]>. |
| Vulnerable: |
Matt Wright WWWBoard 2.0 Alpha 2 |
| Not Vulnerable: | |
Exploit / POC
WWWBoard Password Disclosure Vulnerability
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution / Fix
WWWBoard Password Disclosure Vulnerability
Solution:
Modify the '$passwd_file' Perl variable to point to a password file outside the web document tree. If you web server supports it, you could also configure it to not allow web clients to download the 'passwd.txt' file.
If you use Apache you can do so by adding the following commands to the configuration file:
<Files passwd.txt>
deny from all
</Files>
Solution:
Modify the '$passwd_file' Perl variable to point to a password file outside the web document tree. If you web server supports it, you could also configure it to not allow web clients to download the 'passwd.txt' file.
If you use Apache you can do so by adding the following commands to the configuration file:
<Files passwd.txt>
deny from all
</Files>