TUCoPS :: Web :: Servers :: web5632.htm

Multiple remote attack in MyWebServer
15th Aug 2002 [SBWID-5632]
COMMAND

	Multiple remote attack in MyWebServer

SYSTEMS AFFECTED

	MyWebServer v.1.0.2

PROBLEM

	In D4rkGr3y advisory [http://www.dhgroup.org] :
	

	1. Buffer overflow in MWS  Search  Engine.  Remote  attacker  can  crash
	web-server (and run shell-code) by sending keyword with a large size.
	

	Xsploit:
	

	http://vuln_host/MWS/HandleSearch.html?searchTarget=[990b_of_any_data]&B1=Submit

	

	Fix:    Turn     off     "Search     Page"     in     MWS     properties
	(www.vuln_host.com/admin/ServerProperties.html)
	

	2. Remote JS/VB/HTML code execution.
	

	Xsploit: http://vuln_host/[223b_of_any_data]DEFACED<!--//--

	

	3. Real patch attack.
	

	Xsploit: http://vuln_host/[not_exists_dir]

	

	Then in the document source we can find patch from \ to wwwroot.

SOLUTION

	None yet, check [http://www.mywebserver.org]

TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2024 AOH