vendor:
Apache HTTP Server
by:
SecurityFocus
7.5
CVSS
HIGH
Directory Listing Vulnerability
22
CWE
Product Name: Apache HTTP Server
Affected Version From: 1.3.x
Affected Version To: 1.3.x
Patch Exists: YES
Related CWE: CVE-2002-0392
CPE: a:apache:http_server:1.3.x
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Windows
2002
Apache HTTP Server 1.3.x Directory Listing Vulnerability
Apache HTTP Server 1.3.x (win32) allows people to get a directory listing of a directory, if it is enabled in the config, even if an index file is present that would normally be displayed instead. This can be achieved by sending a number of "/" characters appended to an HTTP request to the server. (eg: http://www.host.com///////////////////////////////////////////////////////...) When apache calls stat() to check if the index.html (for example) exists, Windows will return an error if the path is too long. Apache incorrectly treats this as if the file does not exist. Different numbers of "/"s are required based on the length of the path to the DocumentRoot.
Mitigation:
Disable directory listing in the Apache configuration.