Mollensoft Enceladus Server Suite HTACCESS File Access Weakness

Bugtraq ID:	7889
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 12 2003 12:00AM
Updated:	Jun 12 2003 12:00AM
Credit:	Discovery of this vulnerability credited to Ziv Kamir.
Vulnerable:	Mollensoft Software Enceladus Server Suite 3.9.11 Mollensoft Software Enceladus Server Suite 3.9 Mollensoft Software Enceladus Server Suite 2.6.1
Not Vulnerable:

Mollensoft Enceladus Server Suite HTACCESS File Access Weakness

It has been reported that Enceladus Server Suite does not securely store certain user credentials. This may allow users, who are authorized to access the "Security File Downloads" directory, to gain access to potentially sensitive information. Specifically, the directory htaccess file is stored without access restrictions, making it accessible to users who can access the directory.

Mollensoft Enceladus Server Suite HTACCESS File Access Weakness

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Mollensoft Enceladus Server Suite HTACCESS File Access Weakness

References:

• Home Page (Mollensoft Software)