A PHP Error was encountered

Severity: 8192

Message: Methods with the same name as their class will not be constructors in a future version of PHP; Waterfall_Cache has a deprecated constructor

Filename: _common/waterfall_cache.php

Line Number: 47

A PHP Error was encountered

Severity: 8192

Message: Methods with the same name as their class will not be constructors in a future version of PHP; Cache_System has a deprecated constructor

Filename: _common/waterfall_cache.php

Line Number: 194

A PHP Error was encountered

Severity: 8192

Message: Methods with the same name as their class will not be constructors in a future version of PHP; Memcache_Cache_System has a deprecated constructor

Filename: _common/waterfall_cache.php

Line Number: 275

A PHP Error was encountered

Severity: 8192

Message: Methods with the same name as their class will not be constructors in a future version of PHP; Filesystem_Cache_System has a deprecated constructor

Filename: _common/waterfall_cache.php

Line Number: 440

A PHP Error was encountered

Severity: 8192

Message: Methods with the same name as their class will not be constructors in a future version of PHP; APC_Cache_System has a deprecated constructor

Filename: _common/waterfall_cache.php

Line Number: 628

BugTraq: Advisory: Chili!Soft ASP Multiple Vulnerabilities Page 2

BugTraq: Advisory: Chili!Soft ASP Multiple Vulnerabilities Page 2

By ServerWatch Staff (Send Email)
Posted Feb 21, 2001


    which is probably the only file installed with the correct permissions
    (in this case mode 600).

(3) There are several files installed mode 666 which is a serious no-no as
    some logs and configuration files are affected by this. On my system the
    following files were installed mode 666:

/opt/casp/logs/install_summary
/opt/casp/logs/install
/opt/casp/logs/register
/opt/casp/logs/server-3000
/opt/casp/logs/component
/opt/casp/caspsamp/401K/database/QEDBF.INI
/opt/casp/caspsamp/friendship/agent/database/QEDBF.INI
/opt/casp/caspsamp/friendship/client/database/QEDBF.INI
/opt/casp/caspsamp/QEDBF.INI
/opt/casp/chilicom/lib/hkey.current.user
/opt/casp/chilicom/lib/hkey.local.machine
/opt/casp/INSTALL/.webserver-cache
/opt/casp/.installed_db
/opt/casp/admin/conf/hkey.current.user
/opt/casp/admin/conf/hkey.local.machine
/opt/casp/admin/logs/server

    This may seem bad it gets worse.  Most of the files dealing with
    databases such as global_odbc.ini and odbc.ini are all world-readable and
    thus by default expose passwords administrators may lator install to
    local users.  All configuration files for the server and subsequent other
    services offered Chili!Soft ASP are also world-readable exposing even
    more useful information to local users.

Examples:
http://<server>/caspsamp/codebrws.asp?source=/caspsamp/../admin/conf/service.pwd
http://<server>/caspsamp/codebrws.asp?source=/caspsamp/../global_odbc.ini
http://<server>/caspsamp/codebrws.asp?source=/caspsamp/../admin/logs/server
http://<server>/caspsamp/codebrws.asp?source=/caspsamp/../LICENSE.LIC
http://<server>/caspsamp/codebrws.asp?source=/caspsamp/../logs/server-3000

Solution: Remove all references to the sample ASP file in your httpd.conf and
replace the default admin account.  Then change file permissions in /opt/casp
as your system security dictates (in other words figure it out for yourself)

Vendor Status: Vendor was e-mailed these problems on December 30, 2000.

Copyright )2001 Stan Bubrouski

Page 2 of 2


Comment and Contribute

Your name/nickname

Your email

(Maximum characters: 1200). You have characters left.


 

 


Thanks for your registration, follow us on our social networks to keep up-to-date