Resin Remote Information Disclosure Vulnerability

Affected Systems:

Caucho technology Resin v3.1.0 for Windows

Caucho technology Resin v3.0.21 for Windows

Caucho technology Resin v3.0.20 for Windows

Caucho technology Resin v3.0.19 for Windows

Caucho technology Resin v3.0.18 for Windows

Caucho technology Resin v3.0.17 for Windows

Caucho Technology Resin Professional v3.1.0 for Window

Non-affected system:

Caucho technology Resin v3.1.1 for Windows

Caucho Technology Resin Professional v3.1.1 for Window

Describe:

Bugtraq id:23980

CVE (CAN) id:cve-2007-2688

Resin is a Web server developed by Caucho technology that can be used under the Microsoft Windows operating system.

Multiple vulnerabilities exist on Resin for Windows implementations, which could allow a remote attacker to exploit this vulnerability to obtain sensitive information.

Resin does not properly filter the input transmitted through the URL, allowing a remote attacker to read a continuous stream of data from any COM or LPT device on the system by providing the file name of a DOS device with any extension in the URL, and to expose the contents of the file in the Web application's Web-inf directory through a directory traversal attack. Or, the full system path to the Caucho resin server is compromised through URLs that contain special characters.

<* Source: Derek Abdine

Links: http://secunia.com/advisories/25286/

http://www.rapid7.com/advisories/R7-0028.jsp

http://www.rapid7.com/advisories/R7-0029

http://www.rapid7.com/advisories/R7-0030

*>

Test method:

Warning

The following procedures (methods) may be offensive, for security research and teaching purposes only. Users are at their own risk!

Http://www.example.com:8080/[path]/[device]. [Extension]

Http://www.example.com:8080/%20..\web-inf

Http://www.example.com:8080/%20

Http://www.example.com:8080/[path]/%20.xtp

Suggestions:

Vendor Patches:

Caucho Technology

-----------------

The vendor has released an upgrade patch to fix this security issue, please download it from the manufacturer's homepage:

Http://www.caucho.com/download/resin-pro-3.1.1.tar.gz

Http://www.caucho.com/download/resin-3.1.1.tar.gz

Original from the "Bit network", reproduced please keep the original link: http://sec.chinabyte.com/364/11430864.shtml