Resolve 19, ASP home page. inc File Leak problem
Vulnerability Description:
Affected version: Any system that provides ASP services
Remote: Yes/Local: Yes
Content Summary:
When an ASP's home page is being made and not finished debugging, it can be added as a search object by some search engine maneuver if someone uses the search
The engine searches these pages, gets the location of the files, and sees the details of the database location and structure in the browser to reveal the complete source code.
The specific procedure is:
-Use search engine to find included + "Microsoft VBScript run-time Error Execution Search" + ". Inc," keyword
-Search engine will automatically find included files containing ASP (. inc) and display to the user
-Use the browser to view the source code of the containing file, which may have some sensitive information
Exploit the vulnerability:
Example:
-Http://shopping.altavista.com/inc/lib/prep.lib
Exposing database connectivity and nature, resource location, cookie logic, server IP address
-Http://www.justshop.com/SFLib/ship.inc
Exposing the nature of the database
-Http://www.bbclub.com:8013/includes/general.inc
Exposure cobranding
-Http://www.salest.com/corporate/admin/include/jobs.inc
Exposure to datafile locations and structures
-Http://www.bjsbabes.com/SFLib/design.inc
including database structure for storefront 2000 exposure source code
-Http://www.ffg.com/scripts/IsSearchEngine.inc
Expose search engine record files
-Http://www.wcastl.com/include/functions.inc
Exposing member e-mail addresses
-Http://www.wcastl.com/flat/comments.txt
Exposing members to private note files
-Http://www.traveler.net/two/cookies.inc
Exposing cookie Logic
Solution:
-Search engines should not index pages with ASP run-time errors
-Programmers should thoroughly debug a Web page before it is released
-Security experts need to fix ASP include files so that external users cannot see them
ASP newsgroups, sites offer two solutions to fix this vulnerability by first encrypting the. inc file content, and second, by using the. asp file generation
The. inc file makes it impossible for the user to view the source code of the file directly from the browser. The file name of the. inc file does not use the system default or has special meaning that is easily guessed by the user
When measured, try to use the English alphabet without rules.
