#######################################################################

                             Luigi Auriemma

Application:  Surfboard webserver
              http://surfd.sourceforge.net
Versions:     <= 1.1.8
Platforms:    *nix
Bugs:         possibility to view all the files in the system and
              resources consumption
Exploitation: remote/easy
Date:         01 Dec 2003
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


From the website:
"Surfboard is a trivial web server, written by Meredydd Luff."


#######################################################################

=======
2) Bugs
=======


Directory traversal
-------------------

The webserver checks the dot-dot pattern only if there is a '?' in the
URI (used to pass parameters to the server side scripts), so there is
no protection for the classical directory traversal exploitation.
Note: fortunately the webserver doesn't support indexing of directories
and the version 1.0 is not affected by this bug.


Resource consumption
--------------------

The webserver uses a strange method to read the browser's input: it
does a loop until it receives a second line-feed.
Unfortunately the webserver doesn't check for errors so if the client
breaks the connection it will enter in an infinite loop and the process
(the webserver uses fork()) will be never terminated.


#######################################################################

===========
3) The Code
===========


Directory traversal
-------------------

http://server/../etc/passwd
http://server/../../../etc/passwd


Resource consumption
--------------------

Connect to the server with telnet or netcat and then close the
connection (without sending data).


#######################################################################

======
4) Fix
======


Version 1.1.9


#######################################################################