Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
From: Daniel Nyström (excenetwinder.nu)
Date: Thu May 30 2002 - 17:21:30 CDT

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

      Telhack 026 Inc. Security Advisory - #3

    Name: Shambala Server 4.5
    Impact: Major (FTP Server vuln.), Medium (Web Server vuln.)
    Date: June 30 / 2002

    Daniel Nyström a.k.a. excE <excenetwinder.nu>

    _I N F O_

    Shambala Server is a personal Web/FTP server for Win 9*/NT.
    When the web server is started it also starts the integrated
    FTP server. There are are two previous issues that has been
    disclosed on bugtraq by zillion in 2000 but he seem to have
    missed these things.

    Both of them: http://online.securityfocus.com/archive/1/138501

    Vendor is at: http://www.evolvable.com , and yes, they were notified,
    see bottom.

    _P R O B L E M_

    The integrated FTP server is vulnerable to a directory traversal
    attack, that enables attackers to view the entire directory
    structure and also download any file in it. There are also a
    DoS condition present in the web server.

    _I M P A C T_

    An authenticated user may view any directory and/or download
    any file on the system. An authenticated user may use this
    to download the !_cleartext_! password file that lies one ..
    below the web root.

    I have also found a DoS condition in the Web server that
    generates "Run-time error'5': Invalid procedure call or argument"
    and crashes the server.

    According to www.download.com, the program has been downloaded
    57,957 times and 40 times last week. So it seems like this program
    is still at use.

    _E X P L O I T I N G_

    Directory traversal / get any file
    ftp> ls ../../../ - and so on...
    ftp> get ../../../ - and so on...

    DoS condition in the Web server
    you# telnet 80
    Connected to
    Escape character is '^]'.
    GET !"#¤%&/()=?
    Connection closed by foreign host.

    _F I X E S_

    Spent almost 20 minutes digging in the evolvable.com website for
    an e-mail adress to contact them by, but none found. So I ended
    up taking the e-mail adress from another (2 year old) advisory.
    Still no reply. So the fix for now is: Uninstall Shambala.

    /Daniel Nyström a.k.a. excE Telhack 026 Inc.