| VID |
22080 |
| Severity |
30 |
| Port |
80, ... |
| Protocol |
TCP |
| Class |
WWW |
| Detailed Description |
The remote web server allows an attacker to read arbitrary files on the remote web server, simpling by adding dots in front of its name :
Example:
http://victim.com/../../winnt/boot.ini
will return C:\winnt\boot.ini. This vulnerability exists in the old version of Alibaba web server. Alibaba is a commercial HTTP server manufactured by CSM for Windows 9x and Windows NT.
* References:
http://www.iss.net/security_center/static/2175.php |
| Recommendation |
Contact CSM for patch information. As a temporary fix, you should disable the Alibaba server if possible. |
| Related URL |
CVE-1999-0776 (CVE) |
| Related URL |
(SecurityFocus) |
| Related URL |
(ISS) |
|
