Test ID:	1.3.6.1.4.1.25623.1.0.10803
Category:	Web Servers
Title:	Redhat Stronghold Secure Server File System Disclosure Vulnerability
Summary:	In Redhat Stronghold from versions 2.3 up to 3.0 a flaw; exists that allows a remote attacker to disclose sensitive system files including the; httpd.conf file, if a restricted access to the server status report is not enabled when; using those features.
Description:	Summary: In Redhat Stronghold from versions 2.3 up to 3.0 a flaw exists that allows a remote attacker to disclose sensitive system files including the httpd.conf file, if a restricted access to the server status report is not enabled when using those features. Vulnerability Impact: This may assist an attacker in performing further attacks. By trying the following URLs, an attacker can gather sensitive information: http://example.com/stronghold-info will give information on configuration http://example.com/stronghold-status will return among other information the list of request made Please note that this attack can be performed after a default installation. The vulnerability seems to affect all previous version of Stronghold. Solution: The vendor has released an update on November 19, 2001. CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2001-0868 BugTraq ID: 3577 http://www.securityfocus.com/bid/3577 Bugtraq: 20011123 Redhat Stronghold Secure Server File System Disclosure Vulnerability (Google Search) http://marc.info/?l=bugtraq&m=100654958131854&w=2 XForce ISS Database: apache-strongholdinfo-info-disclosure(51950) https://exchange.xforce.ibmcloud.com/vulnerabilities/51950 XForce ISS Database: apache-strongholdstatus-info-disclosure(51951) https://exchange.xforce.ibmcloud.com/vulnerabilities/51951 XForce ISS Database: stronghold-webserver-obtain-information(7582) https://exchange.xforce.ibmcloud.com/vulnerabilities/7582
Copyright	Copyright (C) 2001 Felix Huber

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.