The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Directory Traversal Exploit in SD Server
------------------------------------------------------------------------
SUMMARY
" <http://www.gdsoftware.dk/> SD Server is an advanced (but very simple to
use) webserver. SD Server is very easy to install, and can handle up to
2000 concurrent connections. SD Server includes advanced scripts for
guestbooks, counters etc."
By exploiting directory traversal vulnerability in SD Server, a malicious
user can obtain files on the system that are located outside of the web
document directory.
DETAILS
Vulnerable Systems:
* SD Server version 4.0.70 and prior
Immune Systems:
* SD Server version 4.0.0.72
Exploit:
By accessing the following URL, a remote user can read the file sam of the
system running SD Server:
http://victimhost/../../../windows/repair/sam
Disclosure Timeline:
* 20/02/2005 Vendor notification.
* 20/02/2005 Vendor response.
* 21/02/2005 Fixed version release (4.0.0.72).
ADDITIONAL INFORMATION
The information has been provided by <mailto:corryl@sitoverde.com>
CorryL.
The original article can be found at: <www.x0n3-h4ck.org>
www.x0n3-h4ck.org
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
