Nessus Plugin #11064

Plugin Index

Note: This file has been created from a downloaded version of the Nessus Plugins from http://www.nessus.org/. Therefore, the information here can be outdated.

BadBlue invalid null byte vulnerability

Family:

CGI abuses

Category:

attack

Copyright:

This script is Copyright (C) 2002 Michel Arboi

Summary:

Read BadBlue protected configuration file

Version:

$Revision: 1.15 $

Cve_id:

CAN-2002-1021

Bugtraq_id:

5226

Xrefs:

-

Description:

It was possible to read the content of /EXT.INI
(BadBlue configuration file) by sending an invalid GET request.

A cracker may exploit this vulnerability to steal the passwords.


Solution : upgrade your software or protect it with a filtering reverse proxy
Risk factor : High