RedHat Stronghold Sensitive File Disclosure Vulnerability (VIGILANTE-2001002)

Vulnerability Key Information Vulnerability Name: RedHat Stronghold Secure Server File System Disclosure Vulnerability Vulnerability Code: VIGILANTE-2001002 Release Date: November 23, 2001 Affected Systems: Stronghold/3.0 Apache/1.3.19 RedHat/3014 (Unix) PHP/3.0.18 mod_ssl/2.8.1 OpenSSL/0.9.6 mod_perl/1.25 Unaffected Systems: Stronghold/3.0 build 3015 Issue Description: In RedHat Stronghold versions 2.3 through 3.0, a vulnerability exists that allows remote attackers to disclose sensitive system files (including the httpd.conf file), when specific features are enabled and server status reporting restricted access is not activated. Attackers can retrieve sensitive information via the following URLs: - : Displays configuration information - : Returns request lists and other information Mitigation: Installing Stronghold/3.0 build 3015 resolves this issue. CVE: Contact has been made with the Common Vulnerabilities and Exposures (CVE) group to obtain a candidate number. Discoverers: This vulnerability was discovered by Madalina Andrei and Reda Zitouni, members of Vigilante’s Safety Watch Team. Additional Information: A test case has been added to SecureScan NX, included in the upgrade package released on November 23, 2001. It is available for review on the SecureScan NX website.

Goal Reached Thanks to every supporter — we hit 100%!

RedHat Stronghold Sensitive File Disclosure Vulnerability (VIGILANTE-2001002)