Directory traversal attacks against the iWeb mini http server. Exploit URLs included. Vendor URL here.
2b782c3d3ced2d812d2176f016730c360d3e63673b1bd7984740c4dae9d99983
October 22 2003
Directory Traversal Attacks on iWeb Web Server.
This is an advisory I did not bother posting to Bugtraq or Full disclosure
because its not a very widespread application. The following two directory
traversal attacks will work on iWeb mini http server
(http://www.ashleybrown.co.uk/iweb/). The 'vendor' has been notified and
is quite aware of the problem. I actually received an email from her
saying these problems won't be fixed and that earlier versions suffered from
the same type of attacks. If you run this webserver as 'Administrator' then
these attacks will be successful because administrator has permissions to these
directories and files.
http://127.0.0.1/..%5C..%5C..%5C..%5C..%5C..%5C/winnt/win.ini
(or any text file in this dir)
http://127.0.0.1/..%5C..%5C..%5C..%5C..%5C..%5C/winnt/system32/registry.inf (or any text file in this dir)
Solution:
Windows 2000 and XP:
Dont run iWeb as administrator, check permissions under winnt folders to make
sure your average users running this do not have permissions to those files.
Windows 95 and 98:
Don't use iWeb :)
chris@cr-secure.net
http://www.cr-secure.net