RadioBird Software's WebServer 4 Everyone is a free "Powerful, MultiClient, yet Easy to handle and maintain, WebServer.". It is available for download at http://www.freeware.lt/ .
Improper bounds checking allow attackers to launch a denial of service (DoS) attack, causing the web server to crash. The condition is triggered when the software receives a request for a long filename, such as GET /AAAAAAAA...3000...AAAA HTTP/1.1 .
A directory traversal issue exists. The software can be duped into serving a restricted file. This is done if an attacker issues a directory traversal request with the hexadecimal representation for the front slash character (%2F). For example, if the URL http://target.server/%2f..%2f..%2f../winnt/repair/sam were sent to a target server, the SAM table would be retrieved.
A vulnerability exists that provides attackers access to arbitrary files on the server running the application.
For Issue 1, exploitation could allow an attacker to deny legitimate users access to the server and the contents that it provides.
For Issue 2, exploitation allows an attacker to obtain sensitive information, such as the Windows NT SAM table. This kind of information can allow further compromise of the targeted host. Sensitive information such as credit cards can also be retrieved.
Customers should note that an remote user with access to the application can launch these attacks.
iDEFENSE has confirmed the existence of both vulnerabilities in WebServer 4 Everyone, versions 1.23 and 1.27. Earlier versions are likely affected, as well.
Leonardas Survila of Radiobird Software released WebServer 4 Everyone, version 1.30, which fixes the problems. It is downloadable at ftp://ftp.freeware.lt/anonymous/Soft/w4asetup.exe.
The Mitre Corp.'s Common Vulnerabilities and Exposures (CVE) Project assigned the identification number CAN-2002-1212 to Issue 1 and CAN-2002-1213 to Issue 2.
10/06/2002 Issue disclosed to iDEFENSE
10/14/2002 Vendor notified via e-mail to email@example.com
10/14/2002 iDEFENSE clients notified
10/14/2002 Response received from Leonardas Survila (firstname.lastname@example.org)
10/15/2002 Vendor fix created
10/15/2002 Coordinated public disclosure
Tamer Sahin (email@example.com) discovered both of these vulnerabilities.