ntop.advisory.txt

`================================================================================  
  
[ Hackerslab bug_paper ] ntop web mode vulnerabliity  
  
================================================================================  
  
  
  
Command : /sbin/ntop -w <port>  
  
  
SYSTEM : N/A  
  
  
INFO :  
  
ntop - display top network users   
  
  
-w  
Starts ntop  
in web mode. Users can attach their web  
browsers to the specified port and browse traffic infor­  
mation remotely. Supposing to start ntop  
at the port 3000  
(ntop -w 3000), the URL to access is http://host­  
name:3000/. The file ~/.ntop specifies the HTTP  
user/password of those people who are allowed to access  
ntop. If the ~/.ntop file is missing no security will be  
used hence everyone can access traffic information. A  
simple .ntop file is the following: # # .ntop File format  
# # user<tab>/<space>pw # # luca linux Please note  
that an HTTP server is NOT needed in order to use the  
program in interactive mode.* 'bdf' program has SUID permission.  
  
  
If use 'ntop' in web mode, it's web root is "/etc/ntop/html".  
  
It's web mode is not check URL path.  
  
So if URL is "http://URL:port/../../shadow", remote user will read all file.  
  
"everyone can access traffic information" !!!  
  
If ntop use for public, anyone read all files.  
  
==-------------------------------------------------------------------------------==  
*********  
* ** ** *  
* ** ** *  
* ******* *  
* ** ** * [email protected]  
* ** ** * [ http://www.hackerslab.org ]  
********* HACKERSLAB (C) since 2000  
==-------------------------------------------------------------------------------==  
  
`