COMMAND

    ICS HTTPServer

SYSTEMS AFFECTED

    ICS HTTPServer

PROBLEM

    Darkstar found  following.   There's a  security vulnerability  in
    the  Delphi  Internet  Component   Suite's  HTTP  server.    These
    components are widly spread.  The vender has been notified of  the
    flaw.

    The  vulnerability  let's  a  person  download  _any_  file on the
    HTTPServer's  computer  using  a  simple  exploit that can be used
    directly from any internet browser.

    Exploit?  Good old dot-dot exploit...

        - Set the HTTP root to 'c:\httproot' and launch the server
        - Start your browser and type
          http://server/../Program%20Files/CuteFTP/smdata.dat

    Download  the  file  and  crack  it.   You  now have all passwords
    stored in the victims CuteFTP  client.  CuteFTP is just  a sample,
    it could be any program that stores passwords.

SOLUTION

    Nothing yet.