Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
parse_xml.cgi in Apple Darwin Streaming Administration Server 4.1.2 and QuickTime Streaming Server 4.1.1 allows remote attackers to obtain the physical path of the server's installation path via a NULL file parameter.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Apple Quicktime/Darwin流服务器parse_xml.cgi远程路径泄露漏洞
Vulnerability Description
Apple Darwin和QuickTime流管理服务器是基于WEB的服务，允许管理员管理Darwin和QuickTime流服务器，默认情况下，这些服务以root用户权限监听1220/TCP端口。 Darwin/QuickTime流服务器的parse_xml.cgi对文件名参数处理不正确，远程攻击者可以利用这个漏洞获得服务器安装物理路径信息。 攻击者如果传递NULL为文件名参数提交给parse_xml.cgi脚本，可导致脚本返回包含服务程序安装物理路径的信息，攻击者可以利用这个信息进一步对系统进行攻击。
CVSS Information
N/A
Vulnerability Type
N/A