Anders Jensen's Dino's Webserver is an HTTP server. The product's website is located at http://home.no.net/~nextgen/.
Exploitation of a vulnerability in the latest version of Dino's Webserver could allow an attacker to view and retrieve any file on the system.
An attacker can construct a URL that would cause Dino's Webserver to navigate to any desired folder in the same logical drive and access the files in it. This can be achieved by using the URL encoded character representations of "/" and "". This allows a user to traverse the server to any directory on the same logical drive as the web application. e.g.
This issue is similar to CVE-2002-0111, which involved a traditional directory traversal flaw that was fixed.
Dino's Webserver 1.2 is affected.
No workaround is available as of this writing.
Anders Jensen (firstname.lastname@example.org) said the following:
"My webserver will be removed from the downloads that I control, I neither have the time or resources to do anything else at the moment."
The public download site, http://home.no.net/~nextgen/ has been replaced with the following message:
"Dino's FunSoft is no longer available. the software will maybe sometime in the future be available on another label, but when and if for sure I really cannot tell, sorry. Dino_"
Dino's Webserver remains available via many other download sites such as Download.com, etc., however.
The Mitre Corp.'s Common Vulnerabilities and Exposures (CVE) Project assigned the identification number CAN-2002-1133 for this issue.
08/10/2002 Issue disclosed to iDEFENSE
09/06/2002 Issue disclosed to vendor
09/06/2002 iDEFENSE clients notified
09/14/2002 Vendor response received
09/23/2002 Issue disclosed to public
Tamer Sahin (email@example.com) is credited with discovering this vulnerability.