Vulnerability

    LocalWEB

Affected

    LocalWEB2000

Description

    Following is based on a SNS Research Advisory.  LocalWEB2000 is  a
    HTTP server for the MS  Windows suite of operating systems.   It's
    intended for  use as  an intranet  server by  small to medium size
    companies.

    Adding the  string "../"  to an  URL allows  an attacker access to
    files  outside  of  the  webserver's  publishing  directory.  This
    allows read access to any file on the server.

    Example:

        http://localhost:80/../../../autoexec.bat

    reads the file "autoexec.bat" from the partition's root dir (using
    default install).

Solution

    Vendor has been  notified, the problem  will be fixed  in a future
    release.  This was tested against LocalWEB2000 v1.1.0.