{"securityvulns": [{"lastseen": "2018-08-31T11:09:27", "bulletinFamily": "software", "description": "Directory traversal, script source code access.", "modified": "2007-12-09T00:00:00", "published": "2007-12-09T00:00:00", "id": "SECURITYVULNS:VULN:8426", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:8426", "title": "Simple HTTPD multiple security vulnerabilities", "type": "securityvulns", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2018-08-31T11:10:24", "bulletinFamily": "software", "description": "\r\n#######################################################################\r\n\r\n Luigi Auriemma\r\n\r\nApplication: Simple HTTPD\r\n http://shttpd.sourceforge.net\r\nVersions: <= 1.38\r\nPlatforms: Windows, *nix, QNX, RTEMS\r\n only Windows seems vulnerable\r\nBugs: A] directory traversal\r\n B] scripts and CGI viewing/downloading\r\n (%20 char found by Shay priel in Jun 2007)\r\nExploitation: remote\r\nDate: 07 Dec 2007\r\nAuthor: Luigi Auriemma\r\n e-mail: aluigi@autistici.org\r\n web: aluigi.org\r\n\r\n\r\n#######################################################################\r\n\r\n\r\n1) Introduction\r\n2) Bugs\r\n3) The Code\r\n4) Fix\r\n\r\n\r\n#######################################################################\r\n\r\n===============\r\n1) Introduction\r\n===============\r\n\r\n\r\nSimple HTTPD (shttpd) is an open source web server created for embedded\r\nsystems.\r\n\r\n\r\n#######################################################################\r\n\r\n=======\r\n2) Bugs\r\n=======\r\n\r\n----------------------\r\nA] directory traversal\r\n----------------------\r\n\r\nUsing the "..\" pattern is possible to download any file in the disk on\r\nwhich is located the web root directory.\r\n\r\n\r\n--------------------------------------\r\nB] scripts and CGI viewing/downloading\r\n--------------------------------------\r\n\r\nAny script or CGI in the server can be viewed/downloaded instead of\r\nbeing executed simply appending the chars '+', '.', %20 (this one\r\nreported by Shay priel in the summer 2007), %2e and any other byte (in\r\nhex format too) major than 0x7f to the requested filename.\r\n\r\n\r\nNote that only Windows seems vulnerable to the above bugs.\r\n\r\n\r\n#######################################################################\r\n\r\n===========\r\n3) The Code\r\n===========\r\n\r\n\r\nA]\r\nhttp://SERVER/..\..\..\boot.ini\r\nhttp://SERVER/..\%2e%2e%5c..\boot.ini\r\n\r\nB]\r\nhttp://SERVER/file.php+\r\nhttp://SERVER/file.php.\r\nhttp://SERVER/file.php%80\r\nhttp://SERVER/file.php%ff\r\n\r\n\r\n#######################################################################\r\n\r\n======\r\n4) Fix\r\n======\r\n\r\n\r\nI have posted the problems in the shttpd-general mailing-list but there\r\nis no reply yet:\r\n\r\n http://sourceforge.net/mailarchive/forum.php?forum_name=shttpd-general\r\n\r\n\r\n#######################################################################\r\n\r\n\r\n--- \r\nLuigi Auriemma\r\nhttp://aluigi.org", "modified": "2007-12-09T00:00:00", "published": "2007-12-09T00:00:00", "id": "SECURITYVULNS:DOC:18598", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:18598", "title": "Two vulnerabilities in Simple HTTPD 1.38", "type": "securityvulns", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2018-08-31T11:10:15", "bulletinFamily": "software", "description": "\r\nTITLE:\r\nPAM-MySQL SQL Logging and Authentication Vulnerabilities\r\n\r\nSECUNIA ADVISORY ID:\r\nSA18598\r\n\r\nVERIFY ADVISORY:\r\nhttp://secunia.com/advisories/18598/\r\n\r\nCRITICAL:\r\nModerately critical\r\n\r\nIMPACT:\r\nDoS, System access\r\n\r\nWHERE:\r\n>From remote\r\n\r\nSOFTWARE:\r\nPAM-MySQL 0.x\r\nhttp://secunia.com/product/7880/\r\n\r\nDESCRIPTION:\r\nSome vulnerabilities have been reported in PAM-MySQL, which\r\npotentially can be exploited by malicious people to cause a DoS\r\n(Denial of Service) or compromise a vulnerable system.\r\n\r\n1) An unspecified error in the SQL logging facility can potentially\r\nbe exploited to cause a DoS.\r\n\r\n2) A double-free error exists in the authentication and\r\nauthentication token alteration code when handling a pointer returned\r\nby the "pam_get_item()" function. This can be exploited by supplying a\r\nspecially crafted password, which results in a DoS or can potentially\r\nbe exploited to execute arbitrary code.\r\n\r\nThe vulnerabilities have been reported in versions 0.6.1 and 0.7pre2.\r\nPrior versions may also be affected.\r\n\r\nSOLUTION:\r\nUpdate to version 0.6.2.\r\n\r\nThe vulnerabilities have also been addressed in version 0.7pre3.\r\n\r\nPROVIDED AND/OR DISCOVERED BY:\r\nReported by the vendor.\r\n\r\nORIGINAL ADVISORY:\r\nPAM-MySQL:\r\nhttp://pam-mysql.sourceforge.net/News/00005.php\r\nhttp://sourceforge.net/forum/forum.php?forum_id=499394\r\n\r\nJVN:\r\nhttp://jvn.jp/cert/JVNVU%23693909/index.html\r\n\r\nOTHER REFERENCES:\r\nUS-CERT VU#693909:\r\nhttp://www.kb.cert.org/vuls/id/693909\r\n\r\n----------------------------------------------------------------------\r\n\r\nAbout:\r\nThis Advisory was delivered by Secunia as a free service to help\r\neverybody keeping their systems up to date against the latest\r\nvulnerabilities.\r\n\r\nSubscribe:\r\nhttp://secunia.com/secunia_security_advisories/\r\n\r\nDefinitions: (Criticality, Where etc.)\r\nhttp://secunia.com/about_secunia_advisories/\r\n\r\n\r\nPlease Note:\r\nSecunia recommends that you verify all advisories you receive by\r\nclicking the link.\r\nSecunia NEVER sends attached files with advisories.\r\nSecunia does not advise people to install third party patches, only\r\nuse those supplied by the vendor.\r\n", "modified": "2006-02-13T00:00:00", "published": "2006-02-13T00:00:00", "id": "SECURITYVULNS:DOC:11403", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:11403", "title": "[SA18598] PAM-MySQL SQL Logging and Authentication Vulnerabilities", "type": "securityvulns", "cvss": {"score": 0.0, "vector": "NONE"}}]}
