| VID |
21010 |
| Severity |
30 |
| Port |
80, ... |
| Protocol |
TCP |
| Class |
CGI |
| Detailed Description |
The 'carbo.dll' CGI is installed on the remote web server and the server appears to be running iCat Carbo Server. iCat Carbo Server is a program used to create interactive online shopping catalogs for the www.
A vulnerability exists in iCat that allows a remote user to view any file on the system iCat is running on. This problem has been confirmed in the 3.0.0 version of the Carbo Server.
For example, To view their c:\winnt\win.ini:
http://host/carbo.dll?icatcommand=..\..\winnt\win.ini&catalogname=catalog
An evil attacker could steal creditcard information from users that have bought something at a site using Carbo Server 3.0.0. |
| Recommendation |
Disable the Carbo Server on your site if possible (specifically, the carbo.dll file) and obtain a patch or upgrade from iCat. |
| Related URL |
CVE-1999-1069 (CVE) |
| Related URL |
2126 (SecurityFocus) |
| Related URL |
1620 (ISS) |
|
