Zeus Web Server Null Terminated Strings Vulnerability

Bugtraq ID:	977
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	Yes
Published:	Feb 08 2000 12:00AM
Updated:	Feb 08 2000 12:00AM
Credit:	Posted on Bugtraq February 9, 2000 by Vanja Hrustic <[email protected]>.
Vulnerable:	Zeus Technologies Zeus Web Server 3.3.5 Zeus Technologies Zeus Web Server 3.3.4 Zeus Technologies Zeus Web Server 3.3.3 Zeus Technologies Zeus Web Server 3.3.2 Zeus Technologies Zeus Web Server 3.3.1 Zeus Technologies Zeus Web Server 3.3 Zeus Technologies Zeus Web Server 3.1.9 Zeus Technologies Zeus Web Server 3.1.8 Zeus Technologies Zeus Web Server 3.1.7 Zeus Technologies Zeus Web Server 3.1.6 Zeus Technologies Zeus Web Server 3.1.5 Zeus Technologies Zeus Web Server 3.1.4 Zeus Technologies Zeus Web Server 3.1.3 Zeus Technologies Zeus Web Server 3.1.2 Zeus Technologies Zeus Web Server 3.1.1
Not Vulnerable:	Zeus Technologies Zeus Web Server 3.3.5 a

Zeus Web Server Null Terminated Strings Vulnerability

Appending "%00" to the end of a CGI script filename will permit a remote client to view full contents of the script if the CGI module option "allow CGIs anywhere" is enabled. Scripts located in directories which are designated as executable (eg. \cgi-bin) are not vulnerable to this exploit.

Zeus Web Server Null Terminated Strings Vulnerability

http ://target/script.cgi%00

"%00" may be replaced with "%G0", "%W0", "%EW", "%FG", "%UW", or "%VG" in order to achieve the same results.

Zeus Web Server Null Terminated Strings Vulnerability

Solution:
Zeus Technologies has provided patches for all 14 platforms Zeus Web Server is compatible with which rectifies this issue. They may be downloaded from the FTP server below:

ftp://ftp.zeustechnology.com/pub/products/z3

Zeus Web Server Null Terminated Strings Vulnerability

References:

• Zeus Technology Homepage (Zeus Technology)