W3C httpd (Formerly 'CERN httpd') Path Revealing Vulnerability
BID:936
Info
W3C httpd (Formerly 'CERN httpd') Path Revealing Vulnerability
| Bugtraq ID: | 936 |
| Class: | Access Validation Error |
| CVE: |
CVE-2000-0079 |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 18 2000 12:00AM |
| Updated: | Jul 11 2009 01:56AM |
| Credit: | First posted to Bugtraq by Niklas Schiffler <[email protected]> on January 18, 2000. |
| Vulnerable: |
W3C httpd 3.0 |
| Not Vulnerable: | |
Discussion
W3C httpd (Formerly 'CERN httpd') Path Revealing Vulnerability
When requesting a cgi-bin document from W3C webserver (also known as CERN) which doesn't exist, the error message will reveal the absolute path of the web documents on the target host's filesystem. The following example was taken from a post to bugtraq by Niklas Schiffler <[email protected]> regarding this issue:
http://www.victim.com/cgi-bin/ls
results in:
Bad script request -- neither '/usr/local/etc/ls' nor '/usr/local/etc/ls.pp' is executable
http://www.victim.com/cgi-bin/cat
results in:
Bad script request -- neither '/usr/local/etc/cat' nor '/usr/local/etc/cat.pp' is executable
When requesting a cgi-bin document from W3C webserver (also known as CERN) which doesn't exist, the error message will reveal the absolute path of the web documents on the target host's filesystem. The following example was taken from a post to bugtraq by Niklas Schiffler <[email protected]> regarding this issue:
http://www.victim.com/cgi-bin/ls
results in:
Bad script request -- neither '/usr/local/etc/ls' nor '/usr/local/etc/ls.pp' is executable
http://www.victim.com/cgi-bin/cat
results in:
Bad script request -- neither '/usr/local/etc/cat' nor '/usr/local/etc/cat.pp' is executable
Exploit / POC
W3C httpd (Formerly 'CERN httpd') Path Revealing Vulnerability
See discussion.
See discussion.
Solution / Fix
W3C httpd (Formerly 'CERN httpd') Path Revealing Vulnerability
Solution:
According to the W3C httpd homepage, the httpd is no longer being maintained by the W3C and has not been since July 1996.
A built-in error message in W3C httpd can be customised quite easily by a line in the httpd configuration file. For example, for the error 500 message, just add to httpd.conf:
ErrorUrl 500 /somepath/myownerrormessage.html
More information at: http://www.w3.org/Daemon/User/Error.html
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution:
According to the W3C httpd homepage, the httpd is no longer being maintained by the W3C and has not been since July 1996.
A built-in error message in W3C httpd can be customised quite easily by a line in the httpd configuration file. For example, for the error 500 message, just add to httpd.conf:
ErrorUrl 500 /somepath/myownerrormessage.html
More information at: http://www.w3.org/Daemon/User/Error.html
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
References
W3C httpd (Formerly 'CERN httpd') Path Revealing Vulnerability
References:
References: