[NT] Apache for Cygwin Directory Traversal (%5C)

• Previous message: SecuriTeam: "[NEWS] Darwin Streaming Server Remote Denial of Service Vulnerability"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

To: list@securiteam.com
Date: 24 Feb 2004 10:26:18 +0200

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

  Apache for Cygwin Directory Traversal (%5C)
------------------------------------------------------------------------

SUMMARY

Apache for Cygwin relies on the Cygwin POSIX.1 emulation layer provided by
the cygwin1.dll dynamic library to create a Unix compatible environment.
The Apache for Cygwin environment has been found to contain a directory
traversal vulnerability.

DETAILS

Vulnerable Systems:
 * Apache version 1.3.29 and prior
 * Apache version 2.0.48 and prior

Exploit:
Using the following code, a malicious user can retrieve any file.
http://[server]/..%5C..%5C..%5C..%5C..%5C..%5C/boot.ini

Solution:
Stipe Tolj, Apache for Cygwin maintainer, released a patch file to fix
this vulnerability on Apache 1.3.29 as shown in the following URL:
<http://nagoya.apache.org/bugzilla/show_bug.cgi?id=26152>
http://nagoya.apache.org/bugzilla/show_bug.cgi?id=26152.

Apache 2 for Cygwin, however, is still vulnerable and is not recommended
for use in a production server.

ADDITIONAL INFORMATION

The information has been provided by <mailto:advisory@stgsecurity.com>
SSR Team.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

• Previous message: SecuriTeam: "[NEWS] Darwin Streaming Server Remote Denial of Service Vulnerability"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Relevant Pages

• [EXPL] Apache mod_rewrite Off-By-One (Exploit)
  ... The following security advisory is sent to the securiteam mailing list, and can be
  found at the SecuriTeam web site: http://www.securiteam.com ... found in mod_rewrite apache
  module to the bugtraq mailing list. ... raised when mod_rewrite is dealing with an LDAP
  URL, ... # Vulnerability discovered by Mark Dowd. ... (Securiteam)
• [NEWS] Apache Multiple Injection Vulnerabilities
  ... The following security advisory is sent to the securiteam mailing list, and can be
  found at the SecuriTeam web site: http://www.securiteam.com ... Apache Multiple Injection Vulnerabilities
  ... Apache is the most widely deployed web server in the Internet. ... (Securiteam)
• [EXPL] Apache Mod_Rewrite Off-by-one Remote Overflow Exploit (win32)
  ... The following security advisory is sent to the securiteam mailing list, and can be
  found at the SecuriTeam web site: http://www.securiteam.com ... Apache Mod_Rewrite Off-by-one
  Remote Overflow Exploit ... The Rewrite module for Apache HTTP Server could allow a ...
  # Vulnerability discovered by Mark Dowd. ... (Securiteam)
• [UNIX] Apache HTTPd Arbitrary Long HTTP Headers DoS
  ... The following security advisory is sent to the securiteam mailing list, and can be
  found at the SecuriTeam web site: http://www.securiteam.com ... The <http://httpd.apache.org/>
  Apache Software Foundation's HTTP Server ... * Apache web server version 2.0.49, ...
  It is possible to consume arbitrary amount of memory using a specially ... (Securiteam)
• [EXPL] Apache Multiple Space Header DoS (Multi-Threaded Exploit)
  ... The following security advisory is sent to the securiteam mailing list, and can be
  found at the SecuriTeam web site: http://www.securiteam.com ... The exploit code below is another
  version of the Apache 2.0.52 DoS ... vulnerability published previously here: ...
  int main(int argc, char **argv){ ... (Securiteam)