OSVDB ID: 27913

Title: Apache HTTP Server on Windows mod_alias URL Validation Canonicalization CGI Source Disclosure

Info

Disclosure
Aug 09, 2006

Discovery
Aug 08, 2006

Dates

Exploit
Aug 09, 2006

Solution
Unknown

Description

 Apache contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when an attacker requests a CGI script with a specially crafted URL, which will disclose the source code of the CGI script resulting in a loss of confidentiality.

Classification

 Location: Remote / Network Access
Attack Type: Information Disclosure, Misconfiguration
Impact: Loss of Confidentiality
Exploit: Exploit Public
Disclosure: OSVDB Verified
OSVDB: Web Related

Solution

 Currently, there are no known upgrades or patches to correct this issue. It is possible to correct the flaw by implementing the following workaround(s): Edit the configuration in 'httpd.conf' to ensure that the directory referenced by 'ScriptAlias' lies outside the directory referenced by 'DocumentRoot'.

Products

Apache Software Foundation

Apache

 2.0.x
2.2.0
2.2.1
2.2.2
2.2.3

References

Credit
  • Susam Pal - susam.palgmail.com -


Direct URL: http://osvdb.org/36218