Lotus Notes Domino Webserver CGI Vulnerabilities
BID:881
Info
Lotus Notes Domino Webserver CGI Vulnerabilities
| Bugtraq ID: | 881 |
| Class: | Unknown |
| CVE: |
CVE-2000-0021 |
| Remote: | Yes |
| Local: | Yes |
| Published: | Dec 21 1999 12:00AM |
| Updated: | Jul 11 2009 01:56AM |
| Credit: | Posted to Bugtraq on Dec 21, 1999 by Alain Thivillon <[email protected]>. |
| Vulnerable: |
Lotus Domino Server 4.6 .x Lotus Domino Server 4.6 |
| Not Vulnerable: | |
Discussion
Lotus Notes Domino Webserver CGI Vulnerabilities
Three vulnerabilities have been discovered in the cgi handling done by Lotus Domino Server's Webserver component.
1: Path information can be obtained.
By submitting a request for a non-existant cgi, an attacker can determine the filesystem structure of the server. Example:
Requested URL:
http: //victimhost/cgi-bin/asdf
Response:
Error 500
Bad script request -- no variation of 'c:/notes/data/domino/cgi-bin/asdf' is executable
2: Anonymous access can not be disabled.
Even with anonymous access turned off on th eserver, it is still permitted for the cgi-bin directory.
3: Buffer overflow in cgi error handling
An overly long URL in a GET request, rooted in the cgi-bin directory, will crash the server. Not all long strings seem to work, but one that was tested and found to work was:
'GET /cgi-bin/[800 ','][4000 'a'] HTTP/1.0'
Three vulnerabilities have been discovered in the cgi handling done by Lotus Domino Server's Webserver component.
1: Path information can be obtained.
By submitting a request for a non-existant cgi, an attacker can determine the filesystem structure of the server. Example:
Requested URL:
http: //victimhost/cgi-bin/asdf
Response:
Error 500
Bad script request -- no variation of 'c:/notes/data/domino/cgi-bin/asdf' is executable
2: Anonymous access can not be disabled.
Even with anonymous access turned off on th eserver, it is still permitted for the cgi-bin directory.
3: Buffer overflow in cgi error handling
An overly long URL in a GET request, rooted in the cgi-bin directory, will crash the server. Not all long strings seem to work, but one that was tested and found to work was:
'GET /cgi-bin/[800 ','][4000 'a'] HTTP/1.0'
Exploit / POC
Lotus Notes Domino Webserver CGI Vulnerabilities
see discussion
see discussion
Solution / Fix
Lotus Notes Domino Webserver CGI Vulnerabilities
Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
References
Lotus Notes Domino Webserver CGI Vulnerabilities
References:
References: