Apple QuickTime/Darwin Streaming Server 4.1.x - 'parse_xml.cgi' File Disclosure

Author: Joe Testa
type: remote
platform: cgi
port: 
date_added: 2003-02-28 
date_updated: 2012-10-28 
verified: 1 
codes: CVE-2003-1414;OSVDB-60285 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/6990/info

A file retrieval vulnerability has been reported for QuickTime/Darwin Streaming Server. The vulnerability exists due to insufficient sanitization of some parameters given to the parse_xml.cgi script. Information obtained in this manner may be used by an attacker to launch more organinzed attacks against a vulnerable system.

This vulnerability was tested on SS for Microsoft Windows systems.

http://localhost:1220/parse_xml.cgi?filename=.../qtusers