TA-2003-06 Directory Transversal Vulnerability in iWeb Server 2

[Rushjo@tripbit.org]

TA-2003-06 Directory Transversal Vulnerability in iWeb Server 2
contributed by: rushjo
================================================== ====================================


Tripbit Security Advisory

TA-2003-06 Directory Transversal Vulnerability in iWeb Server 2
================================================== ====================================




PROGRAM: iWeb Server 2
HOMEPAGE: http://www.ashleybrown.co.uk/iweb/
VULNERABLE VERSIONS: 2
RISK: High/Medium
IMPACT: Directory Transversal Vulnerability
RELEASE DATE: 2003-06


================================================== ====================================
TABLE OF CONTENTS
================================================== ====================================




1................................................. .........DESCRIPTION
2................................................. .............DETAILS
3................................................. ...........SOLUTIONS
4................................................. .......VENDOR STATUS
5................................................. .............CREDITS
6................................................. ..........DISCLAIMER
7................................................. ..........REFERENCES
8................................................. ............FEEDBACK


1. DESCRIPTION
================================================== ====================================




"The iWeb Mini Web Server is a mini web server designed for use on
Intranets and for
testing websites in a realistic environment."

(This description is taken from the website of Ashley Brown)


2. DETAILS
================================================== ====================================




¤ Directory Transversal Vulnerability:


There is an other Directory Transversal Vulnerability in iWeb Server
which allows
an remote attackers to see the content of the requested file.


for example:

http://host/%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cwindows\sys tem.ini



3. SOLUTIONS
================================================== ====================================




No solution for the moment.



5. VENDOR STATUS
================================================== ====================================




The vendor has reportedly been notified. But the vendor told us that is an
old bug. We don't think so.



6. CREDITS
================================================== ====================================




Discovered by posidron



7. DISLAIMER
================================================== ====================================




The information within this paper may change without notice. Use of
this information constitutes acceptance for use in an AS IS condition.
There are NO warranties with regard to this information. In no event
shall the author be liable for any damages whatsoever arising out of
or in connection with the use or spread of this information. Any use
of this information is at the user's own risk.



8. REFERENCES
================================================== ====================================




- Original Version:
http://www.tripbit.org


9. FEEDBACK
================================================== ====================================


Please send suggestions, updates, and comments to:


Tripbit Security Advisory
http://www.tripbit.org
rushjo@tripbit.org
posidron@tripbit.org

[akcess .]

This bug is old. All Tripbit have managed to do is find a new way of
exploiting an old/known bug. Eg by sending the '../' string in
unicode format rather than sending it normally.

The bug was originally found by subversive from the Security Freaks
and the original advisory can be located at:
http://securityfocus.com/archive/1/318775

Of course if tripbit had bothered to check out the validity of
their find before posting it then they would already know this...

Oh and while i'm here i might as well mention that there is two
rather blatent local buffer overflow vulnerabilities in the Tripbit
(rather insecure) "Secure Code Analizer". Both of which are
picked up by the scanner if checking its own source. It seems funny
to me (and rather stupid) that posidron did not bother to scan his
own source for bugs before releasing it on their group site.

It also seems funny to me that no other members of the group noticed
the bugs considering tripbit is supposedly a 'security group' and if
im not mistaken auditing sourcecode is something that 'security
groups' do especially considering how obvious these vulnerabilities
are.

But anyway your probably all dying for me to fill you all in so lets
get down to biznas!

Securecode.c:
http://www.tripbit.org/releases/securecode.c


Details:

akcess@cia:~$ cat -n securecode.c
1 /*
2 * Secure Code Analizer v1.0
3 *
4 * Tripbit Security Development
5 * Author: posidron
6 * Website: tripbit.org
7 *
8 *
9 * ABOUT
10 *
11 * This tool scans your source code to different dangerous functions,
12 * like strcpy(), gets(), getenv(), sscanf() etc.
13 *
14 *
15 * OPTIONS
16 *
17 * [+] single source file -s [SOURCE_FILE]
18 *
19 *
20 * FEATURES
21 *
22 * [+] several source files -m [SOURCE_FILE, SOURCE_FILE ...
]

[...]

40 int main(int argc, char *argv[])
41 {
42 int counter=3;
43 char buffer[1024];

[...]

49 strcpy(buffer,argv[2]);
^^^^^^^^^ BLATENT [IN]SECURECODE.C LOCAL BUFFER OVERFLOW #1!@%$
^^^^^^^^^ STRCPY(BUFFER, ARGV[2]);... ? WHAT IN GODS NAME WERE
^^^^^^^^^ YOU SMOKING WHEN YOU WROTE THIS... ?

[...]

70 int single_source(char *buffer)
71 {
72 char puffer[256];
73 int counter = 1;
74 FILE *source_file;
75 source_file = fopen(buffer, "rt");

[...]

84 while(fgets(puffer, 1024, source_file) != NULL)
^^^^^^^^^ BLATENT [IN]SECURECODE.C LOCAL BUFFER OVERFLOW #2!@%$
^^^^^^^^^ PUFFER ONLY 256 BYTES BIG BUT MAX SIZE THAT WE CAN
^^^^^^^^^ PASS TO PUFFER IS 1024... FOR THOSE OF YOU OUT THERE
^^^^^^^^^ THAT AREN'T GOOD AT MATH 1024 DOES NOT GO INTO 256,
^^^^^^^^^ WHICH MEANS IF WE MAKE SOURCE_FILE BIGGER THAN 256
^^^^^^^^^ THEN KABOOM! SEGMENTATION FAULT... ;D


And there you have it. Not one but TWO blatent vulns in a program
designed for the purpose of finding them, might just be me but i
find this quite ironic, don't you... ? Well done posidron, keep up
the good work!


akcess
--
______________________________________________
http://www.linuxmail.org/
Now with e-mail forwarding for only US$5.95/yr

Powered by Outblaze