Fwd: [Newssubmission: Security vulnerability in the ICS HTTPServer component]

[webmaster () TLSECURITY NET (TLsecurity.net)]

Int_13h
http://www.TLSecurity.net

I thought I forward this over to the List :


http://www.TLSecurity.net


<STRONG>attached mail follows:</STRONG><HR NOSHADE><P>
Hi,

There's a security vulnerability in the Delphi Internet Component Suite's HTTP server. ( 
http://www.rtfm.be/fpiette/indexuk.htm)
These components are widly spread. The vender has been notified of the flaw.

Vulnerability description:

The vulnerability let's a person download _any_ file on the HTTPServer's computer using a simple exploit that can be 
used directly from any internet browser.

Exploit:

Name: Good old dot-dot exploit...

 - Set the HTTP root to 'c:\httproot' and launch the server
 - Start your browser and type
  http://server/../Program%20Files/CuteFTP/smdata.dat
Download the file and crack it
You now have all passwords stored in the victims CuteFTP client.

Note: CuteFTP is just a sample, it could be any program that stores passwords.

Darkstar
dark_star () altavista net
http://browse.to/Darkstar