[15829] in bugtraq
Multiple bugs in Alibaba 2.0
daemon@ATHENA.MIT.EDU (Prizm)
Tue Jul 18 15:50:01 2000
Content-Type: multipart/mixed;boundary="'ThIs-RaNdOm-StRiNg-/=_.354371192:"
Content-Transfer-Encoding: 8bit
Mime-Version: 1.0
Message-Id: <200007181533.IAA21707@Rage.Resentment.org>
Date: Tue, 18 Jul 2000 08:33:16 -800
Reply-To: Prizm <prizm@RESENTMENT.ORG>
From: Prizm <prizm@RESENTMENT.ORG>
To: BUGTRAQ@SECURITYFOCUS.COM
--'ThIs-RaNdOm-StRiNg-/=_.354371192:
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Content-Length: 214
Content-Type: text/plain; charset=iso-8859-1
Details in attached file.
- Prizm
--'ThIs-RaNdOm-StRiNg-/=_.354371192:
Content-Disposition: attachment;filename=alibaba.txt
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Content-Length: 2184
Content-Type: text/plain
Application: Alibaba 2.0
Problem Type: Multiple Problems(3)
Author: Prizm<Prizm@RESENTMENT.org>
Platform(s): Windows 95/98/NT
Vendor Status: Not Informed
Vendor Website: http://csm.alcyonis.fr
Product Description
-------------------
Alibaba is a fully functional http server for windows 95/98/NT. It supports cgi among many other
things. It is easily configurable and is quite easy to use.
Bug #1: Long GET request causes alibaba server to crash
-------------------------------------------------------
The problem, as usual, is with bounds checking.
By doing:
http://www.vulnerable.host.com/[8173 bytes]
The alibaba server will shut down.
Bug #2: Problem in multiple scripts(overwrite and byte injection)
-----------------------------------------------------------------
This was found after reading a previous report on alibaba reguarding several cgi's, get32.exe
included. get16.exe, post16.exe and post32.exe all seem to include the same vulnerability as the
one in get32.exe. Bugs in get32.exe, alibaba.pl and tst.bat were found by Kerb(kerb@fnusa.com).
www.vulnerable.host.com/cgi-bin/post32.exe|echo%20>c:\text.txt
www.vulnerable.host.com/cgi-bin/post16.exe|echo%20>c:\text.txt
www.vulnerable.host.com/cgi-bin/get16.exe|echo%20>c:\text.txt
These will overwrite file.txt, or any file you specify. The get16.exe, post16.exe and post32.exe
programs will also allow the injection of code bytes into any executable file.
Bug #3: All cgi-bin scripts allow listing of alibaba directory
--------------------------------------------------------------
Simply requesting |dir%20c:\[dir] after every cgi script, you can see the contents of the
directory you specified after |dir%20 .
CGI Scripts that seem to be able to do this are: get16.exe, get32.exe, post16.exe, get32.exe,
tst.bat, tst2.bat, lsin.exe, lsindex2.bat, imapcern.exe, imapncsa.exe and aliredir.exe
Vendor Status
-------------
I didn't bother to inform the vendor because the latest version was released in 1996, so i
logically figured they had forgotten about it.
Greetings
---------
Lamagra, Scrippie, eth0, narr0w and many others...
--'ThIs-RaNdOm-StRiNg-/=_.354371192:--
