GEN:SID | 1:2062 |
Message | WEB-MISC iPlanet .perf access |
Summary | server performance and statistics package.
|
Impact | Information disclosure
|
Detailed Information | iPlanet web server uses the file .perf to display performance statistics for the server.
An attacker can access the statistics for the server by making a request for the file .perf.
|
Affected Systems | iPlanet web servers using this object.
|
Attack Scenarios | The attacker merely needs to access http://www.foo.com/.perf
|
Ease of Attack | Simple
|
Corrective Action | Disallow viewing of web server statistics from external sources.
Remove the appropriate lines from the obj.conf file to disallow viewing of server performance statistics.
|
Additional References | |
Rule References | nessus: 11220
|