ID de Prueba:	1.3.6.1.4.1.25623.1.0.10803
Categoría:	Web Servers
Título:	Redhat Stronghold Secure Server File System Disclosure Vulnerability
Resumen:	In Redhat Stronghold from versions 2.3 up to 3.0 a flaw; exists that allows a remote attacker to disclose sensitive system files including the; httpd.conf file, if a restricted access to the server status report is not enabled when; using those features.
Descripción:	Summary: In Redhat Stronghold from versions 2.3 up to 3.0 a flaw exists that allows a remote attacker to disclose sensitive system files including the httpd.conf file, if a restricted access to the server status report is not enabled when using those features. Vulnerability Impact: This may assist an attacker in performing further attacks. By trying the following URLs, an attacker can gather sensitive information: http://example.com/stronghold-info will give information on configuration http://example.com/stronghold-status will return among other information the list of request made Please note that this attack can be performed after a default installation. The vulnerability seems to affect all previous version of Stronghold. Solution: The vendor has released an update on November 19, 2001. CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2001-0868 BugTraq ID: 3577 http://www.securityfocus.com/bid/3577 Bugtraq: 20011123 Redhat Stronghold Secure Server File System Disclosure Vulnerability (Google Search) http://marc.info/?l=bugtraq&m=100654958131854&w=2 XForce ISS Database: apache-strongholdinfo-info-disclosure(51950) https://exchange.xforce.ibmcloud.com/vulnerabilities/51950 XForce ISS Database: apache-strongholdstatus-info-disclosure(51951) https://exchange.xforce.ibmcloud.com/vulnerabilities/51951 XForce ISS Database: stronghold-webserver-obtain-information(7582) https://exchange.xforce.ibmcloud.com/vulnerabilities/7582
Copyright	Copyright (C) 2001 Felix Huber

Esta es sólo una de 146377 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.