Domino HTTP Server Internal Path Disclosure

Notes/Domino 8 Forum

Subject: Domino HTTP Server Internal Path Disclosure

Feedback Type: Problem

Product Area: Domino Server

Technical Area: Security

Platform: Windows 2003 server

Release: 8.0

Reproducible: Always

I have received a security alert from our Securiy Compliance service and they have noted that we have an issue:

Domino HTTP Server Internal Path Disclosure

It is possible to get the absolute path leading to the remote /cgi-bin
directory by requesting a bogus cgi (like : 'GET /cgi-bin/blah'). This
problem can be used to obtain OS and installation details.
Service: Lotus-Domino
CVE: CVE-2000-0021
NVD: CVE-2000-0021
Bugtraq: 881
Reference:
CVSSv2: AV:N/AC:L/Au:N/C:P/I:N/A:N (Base Score: 5.00

BUGTRAQ:19991221 serious Lotus Domino HTTP denial of service
BUGTRAQ:19991227 Re: Lotus Domino HTTP denial of service attack

Can I please get more information regarding this issue and remediation to resolve this issue?

thanks,

john

Feedback number WEBB7HGMU8 created by ~Lisa Fezwevitchoopsi on 08/13/2008