----------------------------------------------------------------------

A new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI
has been released. The new version includes many new and advanced
features, which makes it even easier to stay patched.

Download and test it today:
https://psi.secunia.com/

Read more about this new version:
https://psi.secunia.com/?page=changelog

----------------------------------------------------------------------

TITLE:
HTTP File Server Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA28631

VERIFY ADVISORY:
http://secunia.com/advisories/28631/

CRITICAL:
Moderately critical

IMPACT:
Cross Site Scripting, Spoofing, Manipulation of data, Exposure of
system information, DoS, System access

WHERE:
>From remote

SOFTWARE:
HTTP File Server 2.x
http://secunia.com/product/16793/

DESCRIPTION:
Felipe Aragon and Alec Storm have reported some vulnerabilities and
security issues in HTTP File Server, which can be exploited by
malicious people to disclose system information, conduct spoofing and
cross-site scripting attacks, bypass certain security restrictions,
manipulate data, and potentially compromise a vulnerable system.

1) The application does not correctly log certain input. This can be
exploited to e.g. spoof the username or inject arbitrary content into
the logfile when logging in.

2) Certain input is not properly sanitised before being returned to a
user. This can be exploited to execute arbitrary HTML and script code
in a user's browser session in context of an affected server.

3) It is possible to disclose certain information (e.g. number of
connections, transfer speed, traffic statistics, or uptime) by
sending specially crafted request containing template symbols.

4) The application does not correctly handle the username before
using it to create the file name of the logfile. This can be
exploited to create directories, append data to files, or to cause a
buffer overflow by sending specially crafted requests to a vulnerable
server.

Successful exploitation allows the execution of arbitrary code, but
requires that the "%user%" template symbol is used to define the name
of the logfile.

SOLUTION:
Some of the vulnerabilities are fixed in version 2.2c.
http://www.rejetto.com/hfs/?f=dl

PROVIDED AND/OR DISCOVERED BY:
Felipe Aragon and Alec Storm, Syhunt Security Research Team

ORIGINAL ADVISORY:
http://archives.neohapsis.com/archives/vulnwatch/2008-q1/0008.html
http://archives.neohapsis.com/archives/vulnwatch/2008-q1/0009.html
http://archives.neohapsis.com/archives/vulnwatch/2008-q1/0010.html

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------