The host is running Nostromo nhttpd web server and is prone to directory traversal vulnerability.

Successful exploitation will allow attackers to perform directory traversal attacks and read arbitrary files on the affected application. Impact Level: Application

Upgrade to Nostromo nhttpd to 1.9.4 or later, For updates refer to http://www.nazgul.ch/dev_nostromo.html

The flaw is due to an error in validating '%2f..' sequences in the URI causing attackers to read arbitrary files.

Nostromo nhttpd Version prior to 1.9.4

• http://www.redteam-pentesting.de/en/advisories/rt-sa-2011-001/-nostromo-nhttpd-directory-traversal-leading-to-arbitrary-command-execution
• http://www.securityfocus.com/archive/1/archive/1/517026/100/0/threaded

---

Updated on 2015-03-25