CVE-1999-0607
CVSS5.0
发布时间 :1999-04-20 00:00:00
修订时间 :2016-10-17 21:59:29
NMCOS    

[原文]quikstore.cgi in QuikStore shopping cart stores quikstore.cfg under the web document root with insufficient access control, which allows remote attackers to obtain the cleartext administrator password and gain privileges.


[CNNVD]quikstore.cfg文件泄露敏感信息漏洞(CNNVD-199904-033)

        
        QuikStore是一个商业性的CGI软件包,用来为Web提供一些电子商务功能。
        QuikStoreq的配置文件quikstore.cfg默认权限设置不当,导致敏感信息暴露。
        某些老版本的QuikStore把管理员的用户名和口令以明文的形式存放在一个叫quikstore.cfg的配置文件里,而此文件的默认访问权限是全局可读的,远程用户可以很容易访问到。这样攻击者会轻易控制软件,得到许多用户敏感信息。
        

- CVSS (基础分值)

CVSS分值: 5 [中等(MEDIUM)]
机密性影响: [--]
完整性影响: [--]
可用性影响: [--]
攻击复杂度: [--]
攻击向量: [--]
身份认证: [--]

- CPE (受影响的平台与产品)

产品及版本信息(CPE)暂不可用

- OVAL (用于检测的技术细节)

未找到相关OVAL定义

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0607
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-1999-0607
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-199904-033
(官方数据源) CNNVD

- 其它链接及资源

http://marc.info/?l=bugtraq&m=92462991805485&w=2
(UNKNOWN)  BUGTRAQ  19990420 Shopping Carts exposing CC data

- 漏洞信息

quikstore.cfg文件泄露敏感信息漏洞
中危 配置错误
1999-04-20 00:00:00 2006-06-15 00:00:00
远程※本地  
        
        QuikStore是一个商业性的CGI软件包,用来为Web提供一些电子商务功能。
        QuikStoreq的配置文件quikstore.cfg默认权限设置不当,导致敏感信息暴露。
        某些老版本的QuikStore把管理员的用户名和口令以明文的形式存放在一个叫quikstore.cfg的配置文件里,而此文件的默认访问权限是全局可读的,远程用户可以很容易访问到。这样攻击者会轻易控制软件,得到许多用户敏感信息。
        

- 公告与补丁

        临时解决方法:
        如果您不能立刻安装补丁或者升级,CNNVD建议您采取以下措施以降低威胁:
        * 对文件设置正确的访问权限,禁止从远程直接访问。
        厂商补丁:
        Quikstore
        ---------
        目前厂商还没有提供补丁或者升级程序,我们建议使用此软件的用户随时关注厂商的主页以获取最新版本:
        
        http://www.quikstore.com/

- 漏洞信息

6466
QuikStore Shopping Cart quikstore.cgi Configuration File Disclosure
Remote / Network Access Information Disclosure
Loss of Confidentiality Workaround

- 漏洞描述

- 时间线

1999-04-20 Unknow
Unknow Unknow

- 解决方案

Products

Unknown or Incomplete

- 相关参考

- 漏洞作者

Unknown or Incomplete

- 漏洞信息

Quikstore Plaintext Administrator Password Vulnerability
Configuration Error 1983
Yes Yes
1999-04-20 12:00:00 2009-07-11 03:56:00
First posted to BugTraq on April 20, 1999 by Joe <joe@gonzo.blarg.net>

- 受影响的程序版本

Quikstore Quikstore 1.0
- Larry Wall Perl 5.6
- Larry Wall Perl 5.0 05_003
- Larry Wall Perl 5.0 05
- Larry Wall Perl 5.0 04_05
- Larry Wall Perl 5.0 04
- Larry Wall Perl 5.0 03
Quikstore Quikstore 2.11
- Larry Wall Perl 5.6
- Larry Wall Perl 5.0 05_003
- Larry Wall Perl 5.0 05
- Larry Wall Perl 5.0 04_05
- Larry Wall Perl 5.0 04
- Larry Wall Perl 5.0 03
Quikstore Quikstore 2.10.5
- Larry Wall Perl 5.6
- Larry Wall Perl 5.0 05_003
- Larry Wall Perl 5.0 05
- Larry Wall Perl 5.0 04_05
- Larry Wall Perl 5.0 04
- Larry Wall Perl 5.0 03

- 不受影响的程序版本

Quikstore Quikstore 2.11
- Larry Wall Perl 5.6
- Larry Wall Perl 5.0 05_003
- Larry Wall Perl 5.0 05
- Larry Wall Perl 5.0 04_05
- Larry Wall Perl 5.0 04
- Larry Wall Perl 5.0 03
Quikstore Quikstore 2.10.5
- Larry Wall Perl 5.6
- Larry Wall Perl 5.0 05_003
- Larry Wall Perl 5.0 05
- Larry Wall Perl 5.0 04_05
- Larry Wall Perl 5.0 04
- Larry Wall Perl 5.0 03

- 漏洞讨论

QuikStore is a commercial store front program providing order management, inventory, and other e-commerce related functions to web sites. It is written in perl, and stores configuration information in a separate configuration file for easy setup. Certain older versions of QuikStore stored the administrator name and password in plaintext in this configuration file, named "quikstore.cfg" in these versions. An unsecured default installation leaves this file world-readable, giving remote intruders access to it through the web server. With access to this file and the user/password combination contained in it, the intruder has full administrative access to the online store.

Consequences of an attack could include modification of orders, product information, prices, and gathering of customer credit card information. At the time of writing, the specific affected versions were not known, although versions 2.10.05 and 2.11 are not vulnerable. Any installation storing the administrator name and password in a world readable configuration file is vulnerable. Although this can be fixed by properly configuring file permissions, storing password and account information in plain text is generally a poor approach.

- 漏洞利用

Requesting quikstore.cfg from the cgi-bin directory will retrieve the contents if permissions haven't been set properly.

- 解决方案

Prohibit remote access to the quikstore.cfg file. The latest version of QuikStore encrypts user and password information; contact the vendor for upgrade information.

- 相关参考

 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站