CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:N/A:P
EPSS
Percentile
92.3%
Sambar Webserver displays script contents instead of interpreting them when the user adds certain characters to the end of the script URL.
Sambar Webserver is designed to handle CGI requests by interpreting CGI scripts to produce output returned to the client. However, due to flaws in Sambar Webserverβs URL parsing, it is possible to trick the server into into thinking that a CGI script is a regular file and serving the scriptβs contents instead of interpreting the script. This problem occurs when the client adds a space and a null byte to the end of the script URL.
Attackers can access information that may be considered sensitive, including usernames or passwords contained in CGI scripts.
Apply a patch from your vendor
Upgrade to version 5.2b, available at:
<http://sambar.dnsalias.org/win32-preview.tar.gz>
Remove all CGI scripts from the server, or limit the sensitive information in your CGI scripts.
117139
Filter by status: All Affected Not Affected Unknown
Filter by content: __ Additional information available
__ Sort by: Status Alphabetical
Expand all
Javascript is disabled. Click here to view vendors.
Notified: April 18, 2002 Updated: June 07, 2002
Affected
"A patch is currently available at:
<http://sambar.dnsalias.org/win32-preview.tar.gz> "
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23117139 Feedback>).
Group | Score | Vector |
---|---|---|
Base | ||
Temporal | ||
Environmental |
The content of this document is based on information provided by Peter GrΓΌndl.
This document was written by Shawn Van Ittersum and Jeffrey P. Lanza.
CVE IDs: | CVE-2002-0737 |
---|---|
Severity Metric: | 4.56 Date Public: |