Public Vulnerability Reports

Directory Traversal in Dino's Webserver

09.23.02

BACKGROUND

Anders Jensen's Dino's Webserver is an HTTP server. The product's website is located at http://home.no.net/~nextgen/.

DESCRIPTION

Exploitation of a vulnerability in the latest version of Dino's Webserver could allow an attacker to view and retrieve any file on the system.

ANALYSIS

An attacker can construct a URL that would cause Dino's Webserver to navigate to any desired folder in the same logical drive and access the files in it. This can be achieved by using the URL encoded character representations of "/" and "". This allows a user to traverse the server to any directory on the same logical drive as the web application. e.g.
http://$host/%2f..%2f..%2f..$directory$file.

This issue is similar to CVE-2002-0111, which involved a traditional directory traversal flaw that was fixed.

DETECTION

Dino's Webserver 1.2 is affected.

WORKAROUND

No workaround is available as of this writing.

VENDOR RESPONSE

Anders Jensen (outdoors@tiscali.no) said the following:

"My webserver will be removed from the downloads that I control, I neither have the time or resources to do anything else at the moment."

The public download site, http://home.no.net/~nextgen/ has been replaced with the following message:

"Dino's FunSoft is no longer available. the software will maybe sometime in the future be available on another label, but when and if for sure I really cannot tell, sorry. Dino_"


Dino's Webserver remains available via many other download sites such as Download.com, etc., however.

CVE INFORMATION

The Mitre Corp.'s Common Vulnerabilities and Exposures (CVE) Project assigned the identification number CAN-2002-1133 for this issue.

DISCLOSURE TIMELINE

08/10/2002 Issue disclosed to iDEFENSE
09/06/2002                 Issue disclosed to vendor
09/06/2002                 iDEFENSE clients notified
09/14/2002 Vendor response received
09/23/2002 Issue disclosed to public

CREDIT

Tamer Sahin (ts@securityoffice.net) is credited with discovering this vulnerability.