Sign-up

ID

VAR-200308-0006


CVE

CVE-2003-0425


TITLE

Apple QuickTime/Darwin Streaming Server Directory Traversal Vulnerability

Trust: 0.9

sources: BID: 8258 // CNNVD: CNNVD-200308-119

DESCRIPTION

Directory traversal vulnerability in Apple QuickTime / Darwin Streaming Server before 4.1.3f allows remote attackers to read arbitrary files via a ... (triple dot) in an HTTP request. This vulnerability may be possible to exploit using "/.../" sequences within the request sent to the server. This vulnerability was reported to affect QuickTime/Darwin Streaming Server 4.1.3e and earlier on Windows. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Rapid7, Inc. Security Advisory Visit http://www.rapid7.com/ to download NeXpose, the world's most advanced vulnerability scanner. Linux and Windows 2000/XP versions are available now! _______________________________________________________________________ Rapid7 Advisory R7-0015 Multiple Vulnerabilities Apple QuickTime/Darwin Streaming Server Published: July 22, 2003 Revision: 1.0 http://www.rapid7.com/advisories/R7-0015.html CVE: CAN-2003-0421, CAN-2003-0422, CAN-2003-0423, CAN-2003-0424, CAN-2003-0425, CAN-2003-0426, CAN-2003-0502 1. Affected system(s): KNOWN VULNERABLE: o QuickTime/Darwin Streaming Server v4.1.3 for MacOS X o QuickTime/Darwin Streaming Server v4.1.3 for Win32 o QuickTime/Darwin Streaming Server v4.1.3 for Linux UNKNOWN/NOT TESTED: o other platforms (Solaris) 2. 3. Vendor status and information Apple http://www.apple.com/ The vendor has been notified and has released fixes for all but one of the issues, which is currently under investigation. 4. Solution Upgrade to version 4.1.3g or later of Darwin Streaming Server, which may be obtained as a free download from: http://developer.apple.com/darwin/projects/streaming/ Please see the next section for detailed fix information. 5. Detailed analysis There are several vulnerabilities. Denial of Service by HTTP Request for DOS Device Name CVE ID: CAN-2003-0421 Affects: Darwin Streaming Server v4.1.3e and earlier (Win32 only) Fixed: In version 4.1.3f (Win32) Requesting a DOS device name (e.g. AUX) over HTTP (port 1220) will cause a denial of service on the server. An initial HTTP 404 response will be returned for the device request, but future requests will not be serviced. For example: ==> GET /AUX HTTP/1.0 Denial of Service by Request for ../ DOS Device Name CVE ID: CAN-2003-0502 Affects: Darwin Streaming Server v4.1.3f and earlier (Win32 only) Fixed: In version 4.1.3g (Win32) This is a variant of CAN-2003-0421. A fix for CAN-2003-0421 was included in Streaming Server version, 4.1.3f, but further testing revealed that it was vulnerable to a variant where the device name was prefixed by dotdot slash (../), as in: ==> GET /../AUX HTTP/1.0 Denial of Service by HTTP Request for /view_broadcast.cgi Script CVE ID: CAN-2003-0422 Affects: Darwin Streaming Server v4.1.3e and earlier (Win32 only) Fixed: In version 4.1.3f (Win32) Requesting the /view_broadcast.cgi script over HTTP (port 1220) will cause a denial of service on the server if the required request parameters are not sent. The connection will be closed midway through servicing the request and no new connections will be allowed to the server. Example: ==> GET /view_broadcast.cgi HTTP/1.0 <== HTTP/1.0 200 OK <== Content-Type: video/quicktime <== <== rtsp:// ^^ server drops connection Source Disclosure via HTTP Request for /parse_xml.cgi Script CVE ID: CAN-2003-0423 Affects: Darwin Streaming Server v4.1.3g and earlier Fixed: No fix is available at this time. Apple is aware of this issue and they are investigating it further. The source code of any file within the web root can be obtained by issuing a request for /parse_xml.cgi?filename=[file], where [file] is the file whose source code you wish to view. This is only a serious risk if the administrator has installed custom scripts on Darwin Streaming Server that need to be protected. Script Source Disclosure by Appending Special Characters CVE ID: CAN-2003-0424 Affects: Darwin Streaming Server v4.1.3e and earlier (Win32 only) Fixed: In version 4.1.3f (Win32) The source code of any script can be obtained by appending the special characters %2e (period) or %20 (space) to an HTTP request for that script. For example, requesting /view_broadcast.cgi%2e will reveal the source code for that script. Web Root Traversal and Arbitrary File Disclosure (Win32) CVE ID: CAN-2003-0425 Affects: Darwin Streaming Server v4.1.3e and earlier (Win32 only) Fixed: In version 4.1.3f (Win32) Any file on the system can be retrieved by using three dots to break out of the web root. For example, requesting /.../qtusers will return the QuickTime user/password file. Default Install Allows Remote User to Set Admin Password CVE ID: CAN-2003-0426 Affects: Darwin Streaming Server v4.1.3e and earlier (Mac OS X only) Fixed: In version 4.1.3f (Mac OS X) When Darwin Streaming Server is first installed, the HTTP-based administration server (typically port 1220) presents a "Setup Assistant" page where the user is prompted to set a new administrator password. This would allow any remote user to connect and set up an administrator password before the server administrator has had a chance to do so. 6. Contact Information Rapid7 Security Advisories Email: advisory@rapid7.com Web: http://www.rapid7.com/ Phone: +1 (212) 558-8700 7. Disclaimer and Copyright Rapid7, Inc. is not responsible for the misuse of the information provided in our security advisories. These advisories are a service to the professional security community. There are NO WARRANTIES with regard to this information. Any application or distribution of this information constitutes acceptance AS IS, at the user's own risk. This information is subject to change without notice. This advisory Copyright (C) 2003 Rapid7, Inc. Permission is hereby granted to redistribute this advisory, providing that no changes are made and that the copyright notices and disclaimers remain intact. -----BEGIN PGP SIGNATURE----- Version: PGP 8.0 iQA/AwUBPx3UVST52JC2U8wAEQLPIwCg2Ps9jBufF8N6dGgCaoxEMijMtbcAnRL8 793Plejp5hw/r1OkojX2CQaB =OD0m -----END PGP SIGNATURE-----

Trust: 1.44

sources: NVD: CVE-2003-0425 // BID: 8258 // VULHUB: VHN-7253 // VULMON: CVE-2003-0425 // PACKETSTORM: 31422

AFFECTED PRODUCTS

vendor:applemodel:darwin streaming serverscope:eqversion:4.1.3

Trust: 1.9

vendor:applemodel:quicktime streaming serverscope:eqversion:4.1.3

Trust: 0.3

sources: BID: 8258 // CNNVD: CNNVD-200308-119 // NVD: CVE-2003-0425

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2003-0425
value: MEDIUM

Trust: 1.0

CNNVD: CNNVD-200308-119
value: MEDIUM

Trust: 0.6

VULHUB: VHN-7253
value: MEDIUM

Trust: 0.1

VULMON: CVE-2003-0425
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2003-0425
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.1

VULHUB: VHN-7253
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-7253 // VULMON: CVE-2003-0425 // CNNVD: CNNVD-200308-119 // NVD: CVE-2003-0425

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

sources: NVD: CVE-2003-0425

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200308-119

TYPE

path traversal

Trust: 0.6

sources: CNNVD: CNNVD-200308-119

EXTERNAL IDS

db:NVDid:CVE-2003-0425

Trust: 2.2

db:CNNVDid:CNNVD-200308-119

Trust: 0.7

db:VULNWATCHid:20030723 R7-0015: MULTIPLE VULNERABILITIES APPLE QUICKTIME/DARWIN STREAMING SERVER

Trust: 0.6

db:BIDid:8258

Trust: 0.4

db:VULHUBid:VHN-7253

Trust: 0.1

db:VULMONid:CVE-2003-0425

Trust: 0.1

db:PACKETSTORMid:31422

Trust: 0.1

sources: VULHUB: VHN-7253 // VULMON: CVE-2003-0425 // BID: 8258 // PACKETSTORM: 31422 // CNNVD: CNNVD-200308-119 // NVD: CVE-2003-0425

REFERENCES

url:http://www.rapid7.com/advisories/r7-0015.html

Trust: 1.9

url:http://archives.neohapsis.com/archives/vulnwatch/2003-q3/0040.html

Trust: 1.8

url:http://developer.apple.com/darwin/projects/streaming/

Trust: 0.4

url:https://cwe.mitre.org/data/definitions/.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

url:http://www.apple.com/

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2003-0423

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2003-0426

Trust: 0.1

url:http://www.rapid7.com/

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2003-0502

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2003-0424

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2003-0425

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2003-0421

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2003-0422

Trust: 0.1

sources: VULHUB: VHN-7253 // VULMON: CVE-2003-0425 // BID: 8258 // PACKETSTORM: 31422 // CNNVD: CNNVD-200308-119 // NVD: CVE-2003-0425

CREDITS

Discovery is credited to Rapid7.

Trust: 0.9

sources: BID: 8258 // CNNVD: CNNVD-200308-119

SOURCES

db:VULHUBid:VHN-7253
db:VULMONid:CVE-2003-0425
db:BIDid:8258
db:PACKETSTORMid:31422
db:CNNVDid:CNNVD-200308-119
db:NVDid:CVE-2003-0425

LAST UPDATE DATE

2024-08-14T14:29:30.574000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-7253date:2008-09-10T00:00:00
db:VULMONid:CVE-2003-0425date:2008-09-10T00:00:00
db:BIDid:8258date:2015-03-19T08:46:00
db:CNNVDid:CNNVD-200308-119date:2005-10-20T00:00:00
db:NVDid:CVE-2003-0425date:2008-09-10T19:18:59.307

SOURCES RELEASE DATE

db:VULHUBid:VHN-7253date:2003-08-27T00:00:00
db:VULMONid:CVE-2003-0425date:2003-08-27T00:00:00
db:BIDid:8258date:2003-07-23T00:00:00
db:PACKETSTORMid:31422date:2003-07-23T04:32:56
db:CNNVDid:CNNVD-200308-119date:2003-08-27T00:00:00
db:NVDid:CVE-2003-0425date:2003-08-27T04:00:00