Authentication Circumvention Vulnerability in BlueFace Falcon Web Server

Reported February 13, 2002, by SNS Research.

VERSION AFFECTED

  • Falcon Web Server for Windows

 

DESCRIPTION

An authentication circumvention vulnerability exists in BlueFace’s Falcon Web Server for Windows. A problem in the parsing of requests made to protected directories can let an attacker circumvent the Web server’s authentication scheme and access any file in a protected directory without supplying proper credentials. By supplying an additional backslash at the beginning of the virtual path, an intruder can bypass authentication. For example, an attacker can bypass authentication of the "http://localhost/test" protected directory by accessing “http://localhost//test.”

 

VENDOR RESPONSE

 

The vendor, BlueFace, has been notified and will release build 2.0.0.1021 to correct this problem.

 

CREDIT
Discovered by SNS Research.

Hide comments

Comments

  • Allowed HTML tags: <em> <strong> <blockquote> <br> <p>

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.
Publish