OSVDB ID: 17375

Title: Yaws Web Server .yaws Script Null Byte Request Source Code Disclosure

Info

Disclosure

Jun 17, 2005

Discovery

Jun 01, 2005

Dates

Exploit

Jun 17, 2005

Solution

Unknown

Description

Unknown or Incomplete

Classification

Unknown or Incomplete

Solution

Upgrade to version 1.56 or higher, as it has been reported to fix this vulnerability. In addition, Yaws has released a patch for some older versions.

Products

Unknown or Incomplete

References

Security Tracker: 1014231
Secunia Advisory ID: 15740
CVE ID: 2005-2008 (see also: NVD)
Mail List Post: http://archives.neohapsis.com/archives/fulldisclosure/2005-06/0220.html
Vendor Specific News/Changelog Entry: http://support.nortel.com/go/main.jsp?cscat=DOCDETAIL&DocumentOID=337382&searched=Nortel%20VPN%20Gateway%205.1.3%20Release%20Notes
http://www116.nortel.com/docs/bvdoc/alteon/ssl/SSL-4.2.1.25-README.pdf
http://www116.nortel.com/docs/bvdoc/alteon/sslvpn/216372-E.pdf
Other Advisory URL: http://www.sec-consult.com/181.html
Vendor URL: http://yaws.hyber.org/
Vendor Specific Solution URL: http://yaws.hyber.org/yaws-1.55_to_1.56.patch

Credit

Unknown or Incomplete

Direct URL: http://osvdb.org/36218