accipiter.txt

2004-01-09T00:00:00
ID PACKETSTORM:32497
Type packetstorm
Reporter Mark Bassett
Modified 2004-01-09T00:00:00

Description

                                        
                                            `- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
-  
  
~ Severity: High  
~ Title: Accipiter Direct Server  
~ Date: January 09, 2004  
  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
-  
  
Synopsis  
========  
  
A security vulnerability has been found in Accipiter Direct Server 6  
that allows retrieval of arbitrary files.  
  
Background  
==========  
  
Accipiter Direct Server is responsible for advertisement handling for  
badge and banner ads as well as advertisement tracking. The Direct  
server acts as an http server listening for specially formed requests.  
It is a proprietary system and cannot be disabled.  
  
Description  
===========  
  
Arbitrary files can be viewed by using the exploit detailed in  
CVE-2000-1075  
  
Attacker traverses the http server and retrieves arbitrary files by  
sending specially formed requests through a web browser.  
  
http://accipiterserver/%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cboot.ini  
  
  
  
Workaround  
==========  
  
Vendor will be providing a patch with the next major release. Until  
then you may run your accipiter direct server as an unprivileged user  
restricted to the webroot.  
  
  
Mark Bassett  
Network Administrator  
World media company  
Omaha.com  
402-898-2079  
  
`