File Sharing Software Easy File Sharing Web Server Information Disclosure Vulnerability
BID:8777
Info
File Sharing Software Easy File Sharing Web Server Information Disclosure Vulnerability
| Bugtraq ID: | 8777 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 06 2003 12:00AM |
| Updated: | Oct 06 2003 12:00AM |
| Credit: | Discovery of this vulnerability has been credited to Nimber <[email protected]>. |
| Vulnerable: |
File Sharing Software Easy File Sharing Web Server 1.2 |
| Not Vulnerable: | |
Discussion
File Sharing Software Easy File Sharing Web Server Information Disclosure Vulnerability
Easy File Sharing Web Server has been reported prone to an information disclosure vulnerability. The issue presents itself due to insecure default permissions set on folders that contain Easy File Sharing Web Server log and configuration files. It has been reported that a remote attacker may make a HTTP request for affected log and configuration files and disclose potentially sensitive information contained therein.
Easy File Sharing Web Server has been reported prone to an information disclosure vulnerability. The issue presents itself due to insecure default permissions set on folders that contain Easy File Sharing Web Server log and configuration files. It has been reported that a remote attacker may make a HTTP request for affected log and configuration files and disclose potentially sensitive information contained therein.
Exploit / POC
File Sharing Software Easy File Sharing Web Server Information Disclosure Vulnerability
The following proof of concept has been supplied:
http://www.example.com/log/
Name Size Date Description Author
20030728.txt 9KB 2003-07-28 15:56:34 none none
20030730.txt 18KB 2003-07-30 16:58:58 none none
20030807.txt 12KB 2003-08-07 13:56:18 none none
20030811.txt 18KB 2003-08-11 13:34:15 none none
20030812.txt 10KB 2003-08-12 17:03:20 none none
20030815.txt 10KB 2003-08-15 16:59:58 none none
20030818.txt 31KB 2003-08-18 14:14:30 none none
20030902.txt 9KB 2003-09-02 14:41:57 none none
20030904.txt 8KB 2003-09-04 14:18:59 none none
20030905.txt 1KB 2003-09-05 09:13:28 none none
20030908.txt 4KB 2003-09-08 12:32:22 none none
http://www.example.com/option.ini
The following proof of concept has been supplied:
http://www.example.com/log/
Name Size Date Description Author
20030728.txt 9KB 2003-07-28 15:56:34 none none
20030730.txt 18KB 2003-07-30 16:58:58 none none
20030807.txt 12KB 2003-08-07 13:56:18 none none
20030811.txt 18KB 2003-08-11 13:34:15 none none
20030812.txt 10KB 2003-08-12 17:03:20 none none
20030815.txt 10KB 2003-08-15 16:59:58 none none
20030818.txt 31KB 2003-08-18 14:14:30 none none
20030902.txt 9KB 2003-09-02 14:41:57 none none
20030904.txt 8KB 2003-09-04 14:18:59 none none
20030905.txt 1KB 2003-09-05 09:13:28 none none
20030908.txt 4KB 2003-09-08 12:32:22 none none
http://www.example.com/option.ini
Solution / Fix
File Sharing Software Easy File Sharing Web Server Information Disclosure Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
File Sharing Software Easy File Sharing Web Server Information Disclosure Vulnerability
References:
References:
- Easy File Sharing Web Server Homepage (EFS Software Inc.)
- Vulnerabilities in Easy File Sharing Web Server (1.2 NEW). (Nimber