Philip Curnow's LocalWEB2000 is an HTTP server for Microsoft Corp.'s Windows operating system. More information is available at http://www.intranet-server.co.uk .
Issuing a URL request such as http://localweb.http.server/users.lst to a vulnerable LocalWEB 2000 server can allow access to the plaintext password file stored within (this is the document root directory, i.e. C:Program FilesLocalWEBusers.lst).
Access to the password file allows an attacker to potentially gain access to all protected virtual directories on an affected LocalWEB 2000 server.
LocalWEB2000 Professional 2.1.0 is affected. To determine susceptibility, attempt to retrieve the /users.lst file via a web session.
Under LocalWEB's configuration settings, change the document root virtual directory to a less predictable folder.
Curnow said he is unable to currently support the current release of LocalWEB 2000.
The Mitre Corp.'s Common Vulnerabilities and Exposures (CVE) Project has assigned the identification number CAN-2002-1353 to this issue.
08/29/2002 Issue disclosed to iDEFENSE
09/24/2002 Author notified (email@example.com)
09/25/2002 Response from Author
09/25/2002 iDEFENSE clients notified
09/25/2002 - 12/10/2002 iDEFENSE and Author Communication
12/16/2002 Public Disclosure
Tamer Sahin (firstname.lastname@example.org) discovered this vulnerability.