iPlanet Web Server 4.1 - Search Component File Disclosure Vulnerability

2002-07-09T00:00:00
ID EDB-ID:21603
Type exploitdb
Reporter Qualys Corporation
Modified 2002-07-09T00:00:00

Description

iPlanet Web Server 4.1 Search Component File Disclosure Vulnerability. CVE-2002-1042. Remote exploits for multiple platform

                                        
                                            source: http://www.securityfocus.com/bid/5191/info

The iPlanet Web Server search engine is prone to a file disclosure vulnerability. It is possible for remote attackers to make requests to the search engine which will cause arbitrary readable files on the host running the vulnerable software to be disclosed to the attacker.

This issue was reported for iPlanet Web Server on Microsoft Windows operating systems. Since the server typically runs in the SYSTEM context on these operating systems, it may be possible for an attacker to disclose the contents of arbitrary files. It has not been confirmed whether this vulnerability exists on other platforms that the software is compatible with. The search engine functionality does not appear to be available for versions of the software on Linux platforms.

GET /search?NS-query-pat=..\..\..\..\..\boot.ini