http Server Read Access

Updated 7/10/02

Impact

The web server allows remote users to read arbitrary files on the system. If the password or shadow file can be read, the attacker could crack account passwords and gain access to the system.

Background

Web servers normally service requests for files under their document root directory. For example, if server has its root directory in /var/www/htdocs, and it receives a request for http://server/page.html, it sends the file /var/www/htdocs/page.html back to the client.

The Problem

Operating systems allow path names to refer to a parent directory using the "../" string. An attacker could attempt to exploit this feature to retrieve files from directories outside of the document root directory. Most web servers remove the "../" strings from requested URLs. However, some web servers can still be exploited by using three dots instead of two (".../"), backslash characters ("\../" or "..\"), or extraneous slashes. Others can be tricked into accepting a "../" by encoding the dots into their hexadecimal ASCII representation. Thus a pathname including one or more instances of the string "%2E%2E/" could be used to retrieve arbitrary files from the server.

Other related CVE entries:
CVE 1999-1456 thttpd
CVE 2000-0920 BOA web server
CAN 2001-0037 HomeSeer
CAN 2001-0186 Free Java Web Server
CVE 2001-0189 LocalWEB2000
CAN 2001-0199 SEDUM
CAN 2001-0202 Picserver
CAN 2001-0205 AOLserver
CAN 2001-0206 Soft Lite ServerWorx
CAN 2001-0226 BiblioWeb
CAN 2001-0228 GoAhead
CAN 2001-0286 A1
CAN 2001-0297 Simple Server
CAN 2001-0304 Caucho Resin
CAN 2001-0306 ITAfrica WEBactive
CAN 2001-0454 SlimServe
CVE 2001-0462 Perl web server
CVE 2001-0467 RobTex Viking
CVE 2001-0495 DataWizard WebXQ
CAN 2001-0557 T. Hauck Jana Webserver
CAN 2001-0571 Elron Internet Manager
CVE 2001-0574 MP3Mystic
CVE 2001-0615 Faust Informatics Freestyle chat server
CAN 2001-0674 RobTex Viking
CAN 2001-0971 ACI 4D
CVE 2001-0982 IBM Tivoli WebSEAL Policy Director
CVE 2001-1266 DNHTTPD
CVE 2002-0111 Funsoft Dino's Webserver
CAN 2002-0124 Web Server 4D/eCommerce
CAN 2002-0233 Expressions 4
CAN 2002-0288 Phusion
CAN 2002-0312 Essentia
CAN 2002-0325 BadBlue
CAN 2002-0331 BPM Studio Pro
CAN 2002-0415 RealPlayer
CAN 2002-0482 PCI Netsupport Manager
CAN 2002-0556 Quik-Serv
CVE 2002-0543 Aprelium Abyss
CAN 2002-0708 SurfControl Web Filter Web Report Server
CAN 2002-0784 Lysias Lidik
CAN 2002-1133 Funsoft Dino's Webserver
CAN 2002-1498 SWServer
CAN 2002-1504 WebServer 4 Everyone
CAN 2002-1523 Daniel Arenz Mini Server
CAN 2002-1525 ASTAware SearchDisk engine for Sun ONE Starter Kit
CAN 2003-0312 Snowblind

Resolutions

Contact the vendor of the web server for a fix. If a fix is unavailable, it would be advisable to choose a different web server.

7/10/02
The fix for Cisco Secure ACS, which is based on the Acme.Serve Java package, can be found in the Cisco Advisory.

Where can I read more about this?

For an example of this vulnerability, see Bugtraq and CORE-SDI.

For more information on the Cisco Secure ACS / Acme.Serve vulnerability, see CIAC Bulletin M-097 and Bugtraq.