Vulnerability Note VU#715548

Hummingbird CyberDOCS error page discloses web server installation path

Overview

Hummingbird CyberDOCS contains a vulnerability that could allow a remote attacker to learn the installation path of the web server. This information could be used to support further attacks.

I. Description

Hummingbird CyberDOCS (Hummingbird DM) is a web-based enterprise document management solution that runs on Windows NT/2000 using SQL database technology. A web page generated on an invalid login attempt discloses the full installation path of the web server.

II. Impact

A remote attacker could determine the complete installation path of the CyberDOCS web server. The attacker may be able to use this information to support other attacks.

III. Solution

Apply a patch or upgrade

For CyberDOCS 4.0, apply Patch 4 from the CyberDOCS support site. For versions of CyberDOCS prior to 4.0, Hummingbird recommends that customers upgrade to the most recent version of CyberDOCS.

Systems Affected

Vendor	Status	Date Notified	Date Updated
Hummingbird	Vulnerable	9-Oct-2003

References

http://www.procheckup.com/security_info/vuln_pr0303.html
http://www.hummingbird.com/support/dkm/supportservices/Cyberdocs.html

Credit

This vulnerability was discovered and reported by ProCheckUp.

This document was written by Art Manion.

Other Information

Date Public:	2003-10-06
Date First Published:	2003-10-09
Date Last Updated:	2003-10-10
CERT Advisory:
CVE-ID(s):
NVD-ID(s):
US-CERT Technical Alerts:
Metric:	0.27
Document Revision:	14

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader