Covered by FixVibehigh

ZoneMinder Apache Konfigirasyon Enfòmasyon Divilgasyon (CVE-2016-10140) ZXCVFIXVIBESEGEN ZXCVFIXVIBESEG1 ZoneMinder 1.29 ak 1.30 genyen yon move konfigirasyon Apache ki pèmèt navigasyon anyè san otantifikasyon ak kontoune otantifikasyon potansyèl yo. ZXCVFIXVIBESEGEN ZXCVFIXVIBESEG2 Vèsyon ZoneMinder 1.29 ak 1.30 afekte pa yon pake Apache HTTP Server move konfigirasyon. Defo sa a pèmèt atakè aleka, san otantifikasyon yo browse anyè rasin entènèt la, ki kapab mennen nan divilgasyon enfòmasyon sansib ak kontoune otantifikasyon. ZXCVFIXVIBESEGEN ZXCVFIXVIBESEG3 ## Enpak ZXCVFIXVIBESEGEN ZXCVFIXVIBESEG4 Yon atakè ki aleka ki pa otantifye ka browse repèrtwar ki nan rasin entènèt yon enstalasyon ZoneMinder CVE-2016-10140. Ekspozisyon sa a pèmèt pou divilgasyon enfòmasyon sansib sistèm lan epi li ka mennen nan yon kontourne otantifikasyon konplè, akòde aksè san otorizasyon nan koòdone jesyon aplikasyon an ZXCVFIXVIBETOKEN1ZXCV. ZXCVFIXVIBESEGEN ZXCVFIXVIBESEG5 ## Kòz Rasin ZXCVFIXVIBESEGEN ZXCVFIXVIBESEG6 Se yon konfigirasyon Apache HTTP sèvè ki defektye ki te koze vilnerabilite a ki te fourni ak vèsyon ZoneMinder 1.29 ak 1.30 CVE-2016-10140. Konfigirasyon an echwe restriksyon sou Indexing anyè, sa ki lakòz sèvè wèb la sèvi lis anyè bay itilizatè ki pa otantifye ZXCVFIXVIBETOKEN1ZXCV. ZXCVFIXVIBESEGEN ZXCVFIXVIBESEG7 ## Ratrapaj ZXCVFIXVIBESEGEN ZXCVFIXVIBESEG8 Pou rezoud pwoblèm sa a, administratè yo ta dwe mete ajou ZoneMinder nan yon vèsyon ki gen ladann yon konfigirasyon sèvè entènèt korije CVE-2016-10140. Si yon amelyorasyon imedyat pa posib, fichye konfigirasyon Apache ki asosye ak enstalasyon ZoneMinder yo ta dwe manyèlman fè tèt di pou enfim Indexing anyè epi fè respekte kontwòl aksè strik sou rasin entènèt ZXCVFIXVIBETOKEN1ZXCV. ZXCVFIXVIBESEGEN ZXCVFIXVIBESEG9 ## Rechèch Deteksyon ZXCVFIXVIBESEGEN ZXCVFIXVIBESEG10 Rechèch sou vilnerabilite sa a endike ke deteksyon enplike nan idantifye sikonstans ZoneMinder ak eseye jwenn aksè nan rasin entènèt la oswa sous-dosye li te ye san otantifikasyon CVE-2016-10140. Yon eta vilnerab tipikman endike pa prezans nan modèl lis anyè estanda, tankou "Index of /" fisèl, nan kò a repons HTTP lè pa gen okenn sesyon valab prezan ZXCVFIXVIBETOKEN1ZXCV.

ZoneMinder versions 1.29 and 1.30 are affected by a bundled Apache HTTP Server misconfiguration. This flaw allows remote, unauthenticated attackers to browse the web root directory, potentially leading to sensitive information disclosure and authentication bypass.

CVE-2016-10140CWE-200

Impact

A remote, unauthenticated attacker can browse directories within the web root of a ZoneMinder installation [S1]. This exposure allows for the disclosure of sensitive system information and can lead to a complete authentication bypass, granting unauthorized access to the application's management interface [S1].

Root Cause

The vulnerability is caused by a flawed Apache HTTP Server configuration bundled with ZoneMinder versions 1.29 and 1.30 [S1]. The configuration fails to restrict directory indexing, which results in the web server serving directory listings to unauthenticated users [S1].

Remediation

To address this issue, administrators should update ZoneMinder to a version that includes a corrected web server configuration [S1]. If an immediate upgrade is not possible, the Apache configuration files associated with the ZoneMinder installation should be manually hardened to disable directory indexing and enforce strict access controls on the web root [S1].

Detection Research

Research into this vulnerability indicates that detection involves identifying ZoneMinder instances and attempting to access the web root or known subdirectories without authentication [S1]. A vulnerable state is typically indicated by the presence of standard directory listing patterns, such as the "Index of /" string, in the HTTP response body when no valid session is present [S1].