|
|
[ Message Precedent sur la mailing][ Message Suivant sur la mailing][ Precedent dans le fil][ Prochain dans le fil][ Index par Date][ Index par fil]
[VulnWatch] Syhunt: HFS (HTTP File Server) Username Spoofing and Log Forging/Injection Vulnerability
Syhunt: HFS (HTTP File Server) Username Spoofing and Log
Forging/Injection Vulnerability
Advisory-ID: 200801163
Discovery Date: 1.16.2008
Release Date: 1.23.2008
Affected Applications: HFS 1.5g to and including 2.3(Beta Build
#174); and possibly HFS version 1.5f
Non-Affected Applications: HFS 1.5e and earlier versions
Class: Log Forging/Injection, Username Spoofing
Status: Patch available/Vendor informed
Vendor: Massimo Melina
Vendor URL: link://[click] -or- hfs.sourceforge.net
The Common Vulnerabilities and Exposures (CVE) project has
assigned the following CVEs to these vulnerabilities:
* CVE-2008-0407 - Username Spoofing Vulnerability
* CVE-2008-0408 - Log Forging / Injection Vulnerability
----------------------------------------------------------------
Overview:
HFS is a very popular open source HTTP server designed for
easily sharing files. According to information on the official
website, the HTTP File Server software has been downloaded about
2 million times.
Description:
HFS versions 1.5g to 2.3 Beta (and possibly version 1.5f) are
vulnerable to log forging and username spoofing vulnerabilities.
Remote attackers can appear to be logged in with any desired
username or perform log injection in the log file and GUI panel.
Technical details are included below.
----------------------------------------------------------------
Details (Replicating the issues):
1) Log Forging / Injection Vulnerability
link://[click]
See the "maniplog" command
maniplog [localfilename]
This will inject the content of [localfilename] to the HFS log
panel and file.
2) Username Spoofing Vulnerability
a. Login at link://[click] as [user_x]. Then request
(using a web browser): link://[click]
--or--
b. send a direct request in the following format (does not
require previous login):
GET / HTTP/1.1
(...)
Authorization: Basic dXNlcl95
Both alternatives could make an admin to believe that user Y has
made the HTTP request when reviewing logs.
Additional Considerations:
* Vulnerabilities described here will not allow browsing
protected files and folders.
----------------------------------------------------------------
Vulnerability Status:
The author was contacted and HFS version 2.2c was released. The
new version can be downloaded at www.rejetto.com/hfs/download or
via the "Check for news/updates" option in the HFS menu.
Testers of HFS 2.3 Beta should upgrade to the latest 2.3 beta
build.
HFS 2.3 Beta is only affected if the option "Accept any login
for unprotected resources" is enabled. This option, introduced
in this version, is disabled by default.
----------------------------------------------------------------
Credit:
Felipe Aragon and Alec Storm
Syhunt Security Research Team, www.syhunt.com
---
Copyright © 2008 Syhunt Security
Disclaimer:
The information in this advisory is provided "as is" without
warranty of any kind. Details provided are strictly for
educational and defensive purposes.
Syhunt is not liable for any damages caused by direct or
indirect use of the information provided by this advisory.
Archives de la liste de diffusion Secunia
Archives de la liste de diffusion BugTraq
Archives de la liste de diffusion DailyDave
Archives de la liste de diffusion FunSec
Archives de la liste de diffusion Full Disclosure
Archives de la liste de diffusion Focus-IDS (FD)
Archives de la liste de diffusion Webappsec (FD)
Archives de la liste de diffusion Security-basics (FD)
Archives de la liste de diffusion Vulndiscuss
Archives de la liste de diffusion Vulnwatch
| Mini-Tagwall des articles publiés sur SecuObs : | | | | sécurité, exploit, windows, microsoft, attaque, réseau, outil, vulnérabilité, audit, système, virus, internet, données, metasploit, présentation, linux, bluetooth, protocol, source, vista, scanner, réseaux, shell, rootkit, engineering, conférence, trames, paquet, téléphone, wishmaster, sysun, noyau, mobile, libre, botnet, https, téléphones, rapport, mémoire, scapy, google, patch, reverse, navigateur, snort |
| Mini-Tagwall de l'annuaire video : | | | | security, vmware, virus, biometric, metasploit, windows, lockpicking, password, botnet, tutorial, attack, network, linux, exploit, crypt, source, iphone, secconf, server, shmoocon, conficker, engineering, virtual, wimax, ettercap, rootkit, wireshark, reverse, hackitoergosum, cisco, internet, systm, hacker, firewall, wireless, openbsd, meterpreter, openssh, access, conference, knoppix, arduino, backtrack, brucon, remote |
| Mini-Tagwall des articles de la revue de presse : | | | | security, microsoft, windows, hacker, attack, network, vulnerability, google, exploit, malware, internet, remote, iphone, server, inject, patch, apple, twitter, mobile, virus, ebook, facebook, vulnérabilité, crypt, source, linux, password, intel, research, virtual, phish, access, tutorial, trojan, social, privacy, firefox, adobe, overflow, office, cisco, conficker, botnet, pirate, sécurité |
| Mini-Tagwall des Tweets de la revue Twitter : | | | | security, linux, botnet, attack, metasploit, cisco, defcon, phish, exploit, google, inject, server, firewall, network, twitter, vmware, windows, microsoft, compliance, vulnerability, python, engineering, source, kernel, crypt, social, overflow, nessus, crack, hacker, virus, iphone, patch, virtual, javascript, malware, conficker, pentest, research, email, password, adobe, apache, proxy, backtrack |
|
|
|
|
|
