ID

10766

Nom

Apache Remote Username Enumeration Vulnerability

Auteurs

This script is Copyright (C) 2005-2007 Tenable Network Security

Catégorie

Web Servers

Action

infos

Résumé

Checks for the error codes returned by Apache when requesting a non-existent user name

Description

Synopsis : The remote Apache server can be used to guess the presence of a given user name on the remote host. Description : When configured with the 'UserDir' option, requests to URLs containing a tilde followed by a username will redirect the user to a given subdirectory in the user home. For instance, by default, requesting /~root/ displays the HTML contents from /root/public_html/. If the username requested does not exist, then Apache will reply with a different error code. Therefore, an attacker may exploit this vulnerability to guess the presence of a given user name on the remote host. Solution : In httpd.conf, set the 'UserDir' to 'disabled'. Risk factor : Medium / CVSS Base Score : 5.0 (CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N)

Check for IIS .cnf file leakage
IIS Remote Command Execution
fpcount.exe overflow
Apache < 2.0.63 Multiple XSS Vulnerabilities
Unencrypted NetScaler web management interface
Obsolete Web Server Detection
Apache Directory Listing
Web mirroring
Lighttpd Status Module Information Disclosure Vulnerability
Microsoft IIS Cookie information disclosure
Apache 2.0.39 Win32 directory traversal
Apache < 1.3.41 Multiple Vulnerabilities (DoS, XSS)
Network camera detection
Microsoft Frontpage authors exploits
Broken Web Server Detection
Hidden WWW server name
Zope Invalid Query Path Disclosure
IIS dangerous sample files
Apache mod_proxy content-length buffer overflow
mod_imap Referer Cross Site Scripting Vulnerability
Passwordless frontpage installation
Blue Coat Reporter Detection
CERN HTTPD access control bypass
BadBlue invalid null byte vulnerability
Microsoft .NET Handlers Enumeration
Apache Tomcat servlet/JSP container default files
Apache < 2.2.3
Lotus Domino HTTP server exposes the set up of the filesystem
Microsoft IIS 5.0 Malformed HTTP Printer Request Header Remote Buffer Overflow
VisualRoute Web Server Detection
URLScan Detection
Apache mod_proxy_ftp Directory Component Wildcard Character Globbing XSS
Frontpage Overflow (MS03-051)
NetScaler web management cookie cipher weakness
WS-Management Server Detection
Apache-SSL Client Certificate Forging Vulnerability
Apache < 2.0.59
Blue Coat Reporter Common admin Password
Apache < 2.0.55
F5 BIG-IP Cookie Persistence
MonkeyWeb POST with too much data
Apache::ASP source.asp
Lighttpd mod_fastcgi Header Overflow Vulnerability
shtml.exe reveals full path
mod_gzip running
IIS 5 .printer ISAPI filter applied
Apache = 2.0.51
Authentication bypassing in Lotus Domino
CERN httpd problem
Alibaba 2.0 buffer overflow
Directory listing through WebDAV
IIS .HTR ISAPI filter applied
mod_frontpage installed
Cross-Site Scripting in Cherokee Error Pages
Too long OPTIONS parameter
IMail account hijack
nsiislog.dll Overflow
Apache /server-info accessible
iPlanet Directory Server traversal
Ipswitch Imail WebCalendar Directory Traversal Vulnerability
/scripts Directory Browsable?
Private IP address Leaked using the PROPFIND method
iPlanet Search Engine File Viewing
Lotus Domino Server Information Disclosure Vulnerabilities
Apache mod_ssl denial of service
IIS Unicode Remote Command Execution
Zope Installation Path Disclosure
Web Server Uses Non Random Session IDs
IBM WebSphere Application Server < 6.1.0.17 Unspecified Vulnerability
Apache /server-status accessible
IIS perl.exe problem
Trend Micro OfficeScan Client Directory Traversal Vulnerability
Apache mod_access rule bypass
myServer POST Denial of Service
Lotus Domino administration databases
Apache < 2.0.51
Malformed Hit-Highlighting Argument Vulnerability
MacOS X Finder reveals contents of directories
Netscape Administration Server admin password
Apache < 2.2.9 Multiple Vulnerabilities (DoS, XSS)
lighttpd < 1.4.20 Multiple Vulnerabilities
Apache < 2.0.48
RDS / MDAC Vulnerability Content-Type overflow
No 404 check
Microsoft IIS UNC Mapped Virtual Host Vulnerability
mod_ssl off by one
Test HTTP dangerous methods
Apache < 1.3.37
Format string on URI
Netscape Server ?PageServices bug
IIS Service Pack - 404
Netscape FastTrack get
Webmin Session ID Spoofing
Microsoft IIS Server Hit Hilight Authentication Bypass Vulnerability
mod_survey ENV tags SQL injection
Microsoft Frontpage exploits
IBM WebSphere Application Server < 6.1.0.15 Multiple Vulnerabilities
Sun Java Web Console < 3.0.5 Information Disclosure Vulnerability
Compaq Web Management Server
/iisadmpwd/aexp2.htr
Zope Multiple Vulnerabilities
Too long POST command
Apache Auth Module SQL Insertion Attack
Apache Remote Username Enumeration Vulnerability
HTTP TRACE / TRACK Methods
Zope DoS
Lotus Domino Banner Information Disclosure Vulnerability
Apache < 1.3.27
Microsoft Frontpage dvwssr.dll backdoor
NetScaler web management interface detection
/iisadmin is world readable
IBM WebSphere Application Server 6.1 < Fix Pack 19 Unspecified Vulnerability
Multiple Buffer Overflow Vulnerabilities in mod_jk2 <= 2.0.3
Web Server Uses Plain Text Authentication Forms
HTTP 1.1 header overflow
Netscape Server ?wp bug
Anti Nessus Defense Detection
Check for bdir.htr files
Apache Connection Blocking Denial of Service
mod_python malformed query
ReadDesign Checker
Microsoft .NET Custom Errors Not Set
Apache < 2.0.47
Apache < 2.0.43
Apache Remote Command Execution via .bat files
/scripts/repost.asp
Apache < 2.0.45
F5 BIG-IP web management interface detection
GeoHttpServer Unauthorized Image Access Vulnerability
Check for dangerous Microsoft IIS default files
IIS : Directory listing through WebDAV
mod_ssl overflow
Zope ZClass Permission Mapping Bug
HyperText Transfer Protocol Information
Apache Error Log Escape Sequence Injection
IBM WebSphere Application Server < 6.0.2.31 Multiple Vulnerabilities
Codebrws.asp Source Disclosure Vulnerability
Web Server reverse proxy bug
WebDAV Directories Enumeration
WebLogic Server Buffer dotdot Overflow
Lotus Domino Directory Traversal
IBM Lotus Domino ?open Forced Directory Listing
mod_gzip format string attack
Apache-SSL ExpandCert() Function Certificate Handling Arbitrary Environment Variables Manipulation
mod_python handle abuse
IIS .IDA ISAPI filter applied
Apache < 2.0.46
Ruby on Rails Session Fixation Vulnerability
Zope DocumentTemplate package problem
RDS / MDAC Vulnerability (msadcs.dll) located
HTTP 1.0 header overflow
ipMonitor Directory Traversal
Apache < 1.3.29
CERN httpd CGI name heap overflow
Apache mod_include Privilege Escalation
Apache <= 1.3.33 htpasswd local overflow
htimage.exe overflow
IIS 5.0 Sample App reveals physical path of web root
Microsoft .NET Version Information Disclosure
Apache < 2.2.8 Multiple Vulnerabilities (XSS, DoS)
Apache < 2.0.46 on OS/2
Apache < 1.3.28
Web server traversal
Zope Image Updating Method
Apache Tomcat Default Accounts
WebDAV enabled
McAfee Common Management Agent 3.6.0 Format String Vulnerability
HTTP TRACE