|
|
Virtual Programming VP-ASP测试脚本导致信息泄露漏洞
发布时间：2002-05-31
更新时间：2002-05-31
严重程度：中
威胁程度：服务器信息泄露
错误类型：配置错误
利用方式：服务器模式
BUGTRAQ ID：4843
受影响系统Virtual Programming VP-ASP 4.0
- Microsoft Windows 2000 Advanced Server
- Microsoft Windows 2000 Advanced Server SP1
- Microsoft Windows 2000 Advanced Server SP2
- Microsoft Windows 2000 Datacenter Server
- Microsoft Windows 2000 Datacenter Server SP1
- Microsoft Windows 2000 Datacenter Server SP2
- Microsoft Windows 2000 Professional
- Microsoft Windows 2000 Professional SP1
- Microsoft Windows 2000 Professional SP2
- Microsoft Windows 2000 Server
- Microsoft Windows 2000 Server SP1
- Microsoft Windows 2000 Server SP2
- Microsoft Windows 95
- Microsoft Windows 98
- Microsoft Windows NT Enterprise Server 4.0
- Microsoft Windows NT Enterprise Server 4.0 SP1
- Microsoft Windows NT Enterprise Server 4.0 SP2
- Microsoft Windows NT Enterprise Server 4.0 SP3
- Microsoft Windows NT Enterprise Server 4.0 SP4
- Microsoft Windows NT Enterprise Server 4.0 SP5
- Microsoft Windows NT Enterprise Server 4.0 SP6
- Microsoft Windows NT Enterprise Server 4.0 SP6a
- Microsoft Windows NT Server 4.0
- Microsoft Windows NT Server 4.0 SP1
- Microsoft Windows NT Server 4.0 SP2
- Microsoft Windows NT Server 4.0 SP3
- Microsoft Windows NT Server 4.0 SP4
- Microsoft Windows NT Server 4.0 SP5
- Microsoft Windows NT Server 4.0 SP6
- Microsoft Windows NT Server 4.0 SP6a
- Microsoft Windows NT Workstation 4.0
- Microsoft Windows NT Workstation 4.0 SP1
- Microsoft Windows NT Workstation 4.0 SP2
- Microsoft Windows NT Workstation 4.0 SP3
- Microsoft Windows NT Workstation 4.0 SP4
- Microsoft Windows NT Workstation 4.0 SP5
- Microsoft Windows NT Workstation 4.0 SP6
- Microsoft Windows NT Workstation 4.0 SP6a
- Microsoft Windows XP Home
- Microsoft Windows XP Professional 详细描述
Virtual Programming VP-ASP是商业电子购物系统。
其中存在默认测试脚本'/demo400/shopdbtest.asp'，在处理用户提交的测试时存在漏洞，可返回系统路径给远程用户。
测试代码
请求http://www.vpasp.com/demo400/shopdbtest.asp，提交如下数据库文件：
.xDatabase from .\..\test --> test 测试后返回错误信息：
<quote>
Database Read Database cannot be read Verify that the database is at the
physical location in the open message Microsoft Message
Open Messages
Could not find file 'D:\webs\ausiphotos.com\www\data.mdb'.
Database Write Database cannot be written Verify that the database is in a
folder that has both read and write access Microsoft Message
Open Messages
Could not find file 'D:\webs\ausiphotos.com\www\data.mdb'.
Database Permissions Database Permissions are not correct Read the FAQ on
our web site regarding permission for the anonymous user IUSR
</quote>
解决方案
删除'shopdbtest.asp'文件。
相关信息
hkvrg thdftghr <alias404@hotmail.com>.
参考：http://online.securityfocus.com/archive/1/274230
相关主页：http://www.vpasp.com/
|
