Rule:

--
Sid:

806

--
Summary:
This event is generated when an attempt is made to access a file outside the root directory of a webserver running YaBB.cgi.


--
Impact:

Information disclosure.

--
Detailed Information:

YaBB.cgi is widely used web-based BBS script. Due to input validation problems in YaBB, a remote attacker can traverse the directory structure and view any files and view any file that a webserver has access to.

This event indicates that a remote attacker has attempted to view a file outside the webservers root directory.

--
Affected Systems:

YaBB YaBB 9.1.2000

--
Attack Scenarios:

An attacker issues the following command on port 80 of the webserver:

GET http://target/cgi-bin/YaBB.pl?board=news&action=display&num=../../../../../../../../etc/passwd%00 HTTP/1.0

--
Ease of Attack:

Simple. No exploit software required.

--
False Positives:

None known.

--
False Negatives:

None known.

--
Corrective Action:
 
Update to the latest non-affected version of the software.

--
Contributors:
Original Rule Writer Unknown
Snort documentation contributed by Nawapong Nakjang (tony@ksc.net, tonie@thai.com)
Sourcefire Research Team
Nigel Houghton <nigel.houghton@sourcefire.com>

--
Additional References:


--
