TeamShare TeamTrack目录遍历漏洞-安全小百科

TeamShare TeamTrack目录遍历漏洞

漏洞ID	1105563	漏洞类型	访问验证错误
发布时间	1999-10-02	更新时间	2005-05-02
CVE编号	CVE-1999-0933	CNNVD-ID	CNNVD-199910-009
漏洞平台	Windows	CVSS评分	5.0

|漏洞来源

https://www.exploit-db.com/exploits/19537
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-199910-009

|漏洞详情

TeamTrackweb服务器存在漏洞。远程攻击者借助..(点点）攻击读取任意文件。

|漏洞EXP

source: http://www.securityfocus.com/bid/689/info

TeamTrack 3.00 has a built-in webserver which is meant to be used during the evaluation period, or until IIS or Netscape Enterprise/FastTrack is installed. This server does not filter out requested paths containing the ../ sequence. Because of this, an attacker can specify a file outside of the normal web file structure. The name and relative path (from the web root) of the file must be known by the attacker.

Requesting the following URL from the TeamTrack server will display the contents of the target's SAM file: (NT only)
http ://target.com/../../../../../winnt/repair/sam._

|参考资料

来源:BID
名称:689
链接:http://www.securityfocus.com/bid/689
来源:OSVDB
名称:1096
链接:http://www.osvdb.org/1096

相关推荐: Bogofilter Bogopass不安全临时文件创建漏洞

Bogofilter Bogopass不安全临时文件创建漏洞漏洞ID 1203330 漏洞类型访问验证错误发布时间 2002-12-31 更新时间 2002-12-31 CVE编号 CVE-2002-2267 CNNVD-ID CNNVD-200212-…

文章版权归作者所有，未经允许请勿转载。

THE END