Nessus Plugin #17230

Plugin Index

Note: This file has been created from a downloaded version of the Nessus Plugins from http://www.nessus.org/. Therefore, the information here can be outdated.

CERN HTTPD access control bypass

Family:

CGI abuses

Category:

infos

Copyright:

This script is Copyright (C) 2005 Michel Arboi

Summary:

Determines if web access control can be circumvented

Version:

$Revision: 1.2 $

Cve_id:

-

Bugtraq_id:

-

Xrefs:

-

Description:

It is possible to access protected web pages
by changing / with // or /./
This was a bug in old versions of CERN web server

A work around consisted in rejecting patterns like:
//*
*//*
/./*
*/./*

Solution : Upgrade your web server or tighten your filtering rules
Risk factor : High