Дырка в Sawmill

Специальным образом сконструированный GET-запрос позволяет прочитать первую строчку любого файла, причем приложение запускается от root...

sawmill5.0.21 old path bug & weak hash algorithm

Aleph1, Greetings, I did not see this in the archives so I figured I would forward it on. Vendor: Notified. Link: http://www.flowerfire.com/sawmill SawMill is a site log statistics package for UNIX, Windows and MacOS. I have been evaluating it under Linux. In my test configuration I have sawmill...

Sawmill File Access Information Disclosure

The remote web server is affected by an information disclosure vulnerability due to improper validation of user-supplied input to the 'rfcf' parameter. An unauthenticated, remote attacker can exploit this, via a crafted request, to disclose the first line of arbitrary files on the remote host...

Sawmill Weak Password Encryption Scheme Information Disclosure

The version of Sawmill running on the remote web server is affected by an information disclosure vulnerability due to the use of a weak hash function. An unauthenticated, remote attacker can exploit this to obtain the administrative user password. %NASLMINLEVEL 70300 C Tenable Network Security,...

CVE-2000-0588

SawMill 5.0.21 CGI program allows remote attackers to read the first line of arbitrary files by listing the file in the rfcf parameter, whose contents SawMill attempts to parse as configuration commands...

CVE-2000-0589

SawMill 5.0.21 uses weak encryption to store passwords, which allows attackers to easily decrypt the password and modify the SawMill configuration...

Flowerfire Sawmill 5.0.21 - File Access

Flowerfire Sawmill 5.0.21 - File Access source: https://www.securityfocus.com/bid/1402/info Sawmill is a site statistics package for Unix, Windows and Mac OS. A specially crafted request can disclose the first line of any world readable file for which the full pathname is known, for example...

Flowerfire Sawmill 5.0.21 - Weak Password Encryption

Flowerfire Sawmill 5.0.21 - Weak Password Encryption // source: https://www.securityfocus.com/bid/1403/info Sawmill is a site statistics package for Unix, Windows and Mac OS. Passwords are encrypted using a weak hash function. This combined with the file disclosure vulnerability in Sawmill bid =...

Flowerfire Sawmill 5.0.21 - File Access

source: https://www.securityfocus.com/bid/1402/info Sawmill is a site statistics package for Unix, Windows and Mac OS. A specially crafted request can disclose the first line of any world readable file for which the full pathname is known, for example /etc/passwd. The output of the request is...

Flowerfire Sawmill 5.0.21 - Weak Password Encryption

// source: https://www.securityfocus.com/bid/1403/info Sawmill is a site statistics package for Unix, Windows and Mac OS. Passwords are encrypted using a weak hash function. This combined with the file disclosure vulnerability in Sawmill bid = 1402 could allow an attacker to read the contents of...