Re: KPMG-2002006: Lotus Domino Physical Path Revealed

[Nicolas Gregoire <ngregoire () exaprobe com>]

02/04/2002 16:18:06, Peter Gründl <pgrundl () kpmg dk> wrote :

> Problem:
> ========
> Due to problems handling Windows DOS devices, the Domino Server
> can be brought to show the physical location of the web root.

> Corrective action:
> ==================
> Upgrade to Lotus Domino V5.0.10, which can be downloaded here:
> http://www.notes.net/qmrdown.nsf

This upgrade solves the "banner disclosure" issue too, which was 
presented to Bugtraq readers in my post regarding "physical path 
disclosure" [1].

Apparently, the banner string was hard-coded in the "htcgibin.exe" 
module ...

Thanks to Peter Gründl <pgrundl () kpmg dk> for testing the lastest 
Domino release for this bug.

[1] : http://online.securityfocus.com/archive/1/254768


Nicolas Gregoire
Exaprobe