The remote host appears to be running CERN httpd.  It was possible to get the physical location of a virtual web directory by issuing the request :

  GET /cgi-bin/ls HTTP/1.0

A remote attacker could use this information to mount further attacks.

This plugin attempts to determine the type and the version of the   remote web server.

It was possible to perform a denial of service against the remote web server by sending it a long /cgi-bin relative URL. 

This problem allows an attacker to prevent your Lotus Domino web server from handling requests.

It is possible to get the absolute path leading to the remote /cgi-bin directory by requesting a bogus cgi.  This issue can be used to obtain OS and installation details.

The remote host appears to be running Communigate Pro, a commercial email and groupware application.

It was possible to crash this service by :

  - First, connecting to port 8010 and sending 70 KB     of data (AAA[...]AAA) followed by '\r '.

  - Then, connecting to port 25.

A remote attacker could exploit this to crash the service, or possibly execute arbitrary code.

It was possible to crash the remote WorldClient web server (which allows users to read their mail remotely) by sending :

  GET /aaaaa[...]aaa HTTP/1.0

This issue allows a remote attacker to prevent users from reading their email.

It was possible to crash Webconfig (which is used to configure MDaemon) by sending the request :

  GET /aaaaa[...]aaa HTTP/1.0

This could allow a remote attacker to crash the web server, preventing the MDaemon server from being configured remotely.

It is possible to make the remote thttpd server execute arbitrary code by sending a request like :

	GET / HTTP/1.0 	If-Modified-Since: AAA[...]AAAA 	An attacker may use this to gain control on your computer.

It appears possible to read arbitrary files on the remote host outside the web server's document directory using a specially crafted URL.  An unauthenticated attacker may be able to exploit this issue to access sensitive information to aide in subsequent attacks.

Note that this plugin is not limited to testing for known vulnerabilities in a specific set of web servers. Instead, it attempts a variety of generic directory traversal attacks and considers a product to be vulnerable simply if it finds evidence of the contents of '/etc/passwd' or a Windows 'win.ini' file in the response. It may, in fact, uncover 'new' issues, that have yet to be reported to the product's vendor.

It is possible to read arbitrary files on the remote server by prepending ../../ or ..\..\ in front of the file name.

The version of Eserv running on the remote host is vulnerable to a directory traversal attack.  It is possible to read arbitrary files on the server by prepending ../../ or ..\..\ in front of the file name.  A remote attacker could exploit this to read arbitrary files on the server, which could be used to mount further attacks.

The remote host is running a vulnerable version of the Xitami web server. An attacker could exploit this by sending a lot of data to TCP port 81. This could lead to the execution of arbitrary code in the context of the web server, or create a denial of service.

It is possible to make the remote web server execute arbitrary commands by sending the following request:

	POST AA[...]AA/ HTTP/1.0 	This problem may allow an attacker to execute arbitrary code on the remote system or create a denial of service (DoS) attack.

The remote host contains a file named 'robots.txt' that is intended to prevent web 'robots' from visiting certain directories in a website for maintenance or indexing purposes.  A malicious user may also be able to use the contents of this file to learn of sensitive documents or directories on the affected site and either retrieve them directly or target them for other attacks.

The remote web server seems to crash when it is issued a too long argument to the 'Accept:' command :

Example :

 GET / HTTP/1.0 Accept: <thousands of chars>/gif

This may allow an attacker to execute arbitrary code on the remote system.

The remote web server appears to be running with Microsoft FrontPage extensions. The file 'authors.pwd', which contains the encrypted passwords of FrontPage authors, can by accessed by anyone. A remote attacker could decrypt these passwords, or possibly overwrite this file.

The remote web server appears to be running with the FrontPage extensions.  

FrontPage allows remote web developers and administrators to modify web content from a remote location.  While this is a fairly typical scenario on an internal local area network, the FrontPage extensions should not be available to anonymous users via the Internet (or any other untrusted 3rd party network).

It was possible to crash the remote web server by sending a malformed header request. This flaw allows an attacker to shut down your web server, thus preventing legitimate users from connecting to your web server.

It is possible to browse the remote web server directories by appending '?open' to the end of the URL.  For example :

	http://www.example.com/?open

Data that can be accessed by unauthorized users may include usernames, server names and IP addresses, dial-up server phone numbers, administration logs, files names, and data files (including credit card information, proprietary corporate data, and other information stored in eCommerce related databases.) In some instances, it may be possible for an unauthorized user to modify these files or perform server administration functions via the web administration interface.

There is an SSL handshake bug in the remote secure web server that could lead to a denial of service attack. 

An attacker may use this flaw to prevent your site from working properly.

The remote web server crashes when it receives a too long URL. It might be possible to make it execute arbitrary code through this flaw.

The remote HTTP server allows an attacker to read arbitrary files on the remote host with the privileges of the web server, simply by adding a slash in front of its name. 

For instance, 'GET //etc/passwd' will return the contents of the remote file '/etc/passwd'.

When the remote web server is issued a request with a lower-case 'get', it will return a directory listing even if a default page such as index.html is present. 		For example :
		get / HTTP/1.0

will return a listing of the root directory. 

This allows an attacker to gain valuable information about the directory structure of the remote host and could reveal the presence of files that are not intended to be visible.

The version of Netscape Server running on the remote host is affected by an information disclosure vulnerability. An unauthenticated, remote attacker can exploit this, by using a crafted URL request with '?PageServices' appended, to display a listing of the page directory, which may contain sensitive files.

The remote MetaInfo web server (installed with MetaInfo's Sendmail or MetaIP servers) has an arbitrary command execution vulnerability. It is possible to read files or execute arbitrary commands by prepending the appropriate number of '../' to the desired filename. A remote attacker could exploit this to execute arbitrary commands on the system.

It was possible to obtain the physical location of a virtual web directory of this host by issuing a request for a non-existent file with an IISAPI-registered extension.

An attacker may use this flaw to gain more information about the remote host, and hence make more focused attacks.

It is possible to crash IIS by sending the request GET ../../'

The remote IIS web server is affected by a remote buffer overflow vulnerability. A malformed request for an .HTR, .STM, or .IDC file could lead to a denial of service, or possibly remote arbitrary code execution.

iChat servers up to version 3.00 allow any user to read arbitrary files on the target system using a directory traversal attack.

ID	Name	Severity
10037	CERN httpd Virtual Web Path Disclosure	medium
10107	HTTP Server Type and Version	info
10059	IBM Lotus Domino HTTP /cgi-bin Relative URL Request DoS	medium
10058	IBM Lotus Domino HTTP Server Filesystem Setup Disclosure	medium
10048	CommuniGate Pro HTTP Configuration Port Remote Overflow	high
10139	MDaemon WorldClient HTTP Server URL Overflow DoS	medium
10138	MDaemon WebConfig HTTP Server URL Overflow DoS	medium
10285	thttpd 2.04 If-Modified-Since Header Remote Buffer Overflow	critical
10297	Web Server Directory Traversal Arbitrary File Access	high
10091	FTPGate Web Proxy Traversal Arbitrary File Access	medium
10063	Eserv GET Request Traversal Arbitrary File Access	medium
10322	Xitami Web Server Administration Port Remote Overflow	critical
10012	Alibaba Web Server 2.0 HTTP Request Overflow DoS	high
10302	Web Server robots.txt Information Disclosure	info
10154	Netscape Enterprise Server Accept Header Remote Overflow	medium
10078	Microsoft FrontPage Extensions authors.pwd Information Disclosure	medium
10077	Microsoft FrontPage Extensions Check	medium
10119	Microsoft IIS Malformed HTTP Request Header Remote DoS	medium
10057	IBM Lotus Domino ?open Forced Directory Listing	medium
10155	Netscape Enterprise Server SSL Handshake DoS	medium
10320	Web Server Long URL Handling Remote Overflow DoS	high
10286	thttpd Double Slash Request Arbitrary File Access	medium
10156	Netscape FastTrack get Command Forced Directory Listing	medium
10153	Netscape Server ?PageServices Request Forced Directory Listing	medium
10141	MetaInfo Web Server Traversal Arbitrary Command Execution	critical
10120	Microsoft IIS perl.exe HTTP Path Disclosure	medium
10117	Microsoft IIS Traversal GET Request Remote DoS	medium
10116	Microsoft IIS ISM.DLL HTR Request Remote Overflow	critical
10110	iChat Server Traversal Arbitrary File Access	medium

Detections

Analytics

Web Servers Family for Nessus

medium

info

medium

medium

high

medium

medium

critical

high

medium

medium

critical

high

info

medium

medium

medium

medium

medium

medium

high

medium

medium

medium

critical

medium

medium

critical

medium