header-logo
Suggest Exploit
vendor:
Linux
by:
SecurityFocus
3.3
CVSS
MEDIUM
Directory Indexing
564
CWE
Product Name: Linux
Affected Version From: Mandrake Linux 6.1
Affected Version To: Mandrake Linux 7.1
Patch Exists: YES
Related CWE: N/A
CPE: o:mandrakesoft:linux:7.1
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: None
2002

Misconfiguration in mod_perl shipped with Mandrake Linux 6.1 through 7.1

The default configuration files for versions of mod_perl shipped with Mandrake Linux 6.1 through 7.1 contain a misconfiguration that can be a security concern in some situations. The /perl directory is part of the webserver's root tree (the subdirectory tree from which files are accessable on the webserver..) that is used to store perl scripts. In the configuration file for mod_perl, the apache perl interpreter module, the directory is permitted to be 'indexed' meaning that the webserver will display the contents of the directory if it is requested by itself. The result is that an attacker can see what files are in /perl. While this bug does not affect how the webserver interprets the files in that directory (eg., it will still execute them), knowing what is there to be executed can allow for more targeted and intelligent attacks against scripts known to be vulnerable listed there.

Mitigation:

Ensure that the /perl directory is not indexed by the webserver.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/1678/info

The default configuration files for versions of mod_perl shipped with Mandrake Linux 6.1 through 7.1 contain a misconfiguration that can be a security concern in some situations. The /perl directory is part of the webserver's root tree (the subdirectory tree from which files are accessable on the webserver..) that is used to store perl scripts. In the configuration file for mod_perl, the apache perl interpreter module, the directory is permitted to be "indexed".. meaning that the webserver will display the contents of the directory if it is requested by itself. The result is that an attacker can see what files are in /perl. While this bug does not affect how the webserver interprets the files in that directory (eg., it will still execute them), knowing what is there to be executed can allow for more targeted and intelligent attacks against scripts known to be vulnerable listed there.

Point your web browser to http://target/perl.