What is port TCP 8135 used for?

[jip]

Did a scan on it and got this back, which looks pretty bad.
I *think* I read somewhere that it is related to BTV, but wanted to make sure.

Thanks
- J

=========================

The remote web server is vulnerable to a path traversal vulnerability.

An attacker may exploit this flaw to read arbitrary files on the remote
system with the privileges of the http process.

Requesting the file c:\boot.ini returns :


[boot loader]

timeout=30

[Cross673]

Here are the ports that BTV uses.

8129: Beyond TV uses this port for access to the Web Admin interface.
1755: Beyond TV uses this port to stream recorded content through Web Admin.
8080: Beyond TV uses this port to stream live TV through Web Admin.
8135: Beyond TV uses this port to download shows through Web Admin.

If you use a router, then you'll need to configure it to forward to those ports.

[jip]

I don't recommend opening port 8135 to the Internet because of the vulnerabilties mentioned on my original post.

I hope the developers are reading this post.

- J

[Cross673]

You can password protect your BTV Web Admin. Therefore the security risk should be greatly reduced.

[jip]

I don't think you understand. The web server is vulnerable regardless of password protection or not.

- j

[HomeyFour]

I think your mistaking an IIS/windows type server vulnerability. Someone who is trying to hack in through an open BTV port is not going to get very far.

Can you please elaborate on where/what source you got this information from that claims of this vulnerability? Something is fishy.

[jip]

I ran nessus against it.
Nessus could be wrong, but I rather not take my chances and expose this port to the Internet until someone from SS looks into it. I will see if I can come up w/ an example URL that exploits this.

Thanks
- J


----------------

Here is what the scanner reports shows..


The remote web server is vulnerable to a path traversal vulnerability.

An attacker may exploit this flaw to read arbitrary files on the remote
system with the privileges of the http process.

Requesting the file c:\boot.ini returns :







[boot loader]

timeout=30

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOW S

[operating systems]

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Micro soft Windows XP Professional" /fastdetect /NoExecute=OptIn



Solution : upgrade your web server or change it.
Risk factor : High
CVE : CVE-2004-2628
BID : 10862
Other references : OSVDB:8372


------------------


I looked at the plugin code and could not easily find out how the URL was crafted that allowed it to pull the system file c:\boot.ini

Thanks
- J