|
WWW File Share Pro Multiple Vulnerabilities
|
|
Secunia Advisory:
|
SA10646
|
|
|
Release Date:
|
2004-01-16
|
|
Popularity:
|
6,391 views
|
|
|
Critical:
|
Moderately critical
|
|
Impact:
|
Security Bypass
Exposure of sensitive information
DoS
|
|
Where:
|
From remote
|
|
Solution Status:
|
Vendor Patch
|
|
| Software: | WWW File Share Pro 2.x
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
Description:
Luigi Auriemma has identified multiple vulnerabilities in WWW File Share Pro, allowing malicious people to bypass restrictions or cause a Denial of Service.
1) It is possible to upload files to arbitrary locations using the default upload feature. The problem is that the upload function fails to identify file names with the "../" character sequence. Any file, which is writable by the web server process, can be overwritten.
2) It is possible to cause the server process to consume 100% CPU resources or possibly freeze the entire system by sending HTTP POST requests larger than 2 MB.
3) The directory password protection mechanism can be bypassed by pre- or suffixing the directory name with different characters such as "\", "." and "//". This allows malicious people to access the contents of directories without the use of an username and password.
The vulnerabilities affect versions prior to 2.46.
Solution:
Update to version 2.46.
http://www.wfshome.com/download.htm
Provided and/or discovered by:
Luigi Auriemma
Original Advisory:
Luigi Auriemma:
http://aluigi.altervista.org/adv/wfshare-adv.txt
LionMax Software:
http://www.wfshome.com/#new
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
