[NT] Apache for Cygwin Directory Traversal (%5C)

From: SecuriTeam (support_at_securiteam.com)
Date: 02/24/04

  • Next message: SecuriTeam: "[NEWS] Cisco ONS 15327, ONS 15454, ONS 15454 SDH, and ONS 15600 Vulnerabilities" 
    To: list@securiteam.com
Date: 24 Feb 2004 10:26:18 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Apache for Cygwin Directory Traversal (%5C)
    ------------------------------------------------------------------------

    SUMMARY

    Apache for Cygwin relies on the Cygwin POSIX.1 emulation layer provided by
    the cygwin1.dll dynamic library to create a Unix compatible environment.
    The Apache for Cygwin environment has been found to contain a directory
    traversal vulnerability.

    DETAILS

    Vulnerable Systems:
     * Apache version 1.3.29 and prior
     * Apache version 2.0.48 and prior

    Exploit:
    Using the following code, a malicious user can retrieve any file.
    http://[server]/..%5C..%5C..%5C..%5C..%5C..%5C/boot.ini

    Solution:
    Stipe Tolj, Apache for Cygwin maintainer, released a patch file to fix
    this vulnerability on Apache 1.3.29 as shown in the following URL:
    <http://nagoya.apache.org/bugzilla/show_bug.cgi?id=26152>
    http://nagoya.apache.org/bugzilla/show_bug.cgi?id=26152.

    Apache 2 for Cygwin, however, is still vulnerable and is not recommended
    for use in a production server.

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:advisory@stgsecurity.com>
    SSR Team.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[NEWS] Cisco ONS 15327, ONS 15454, ONS 15454 SDH, and ONS 15600 Vulnerabilities"

    Relevant Pages

    • [EXPL] Apache mod_rewrite Off-By-One (Exploit)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... found in mod_rewrite apache module to the bugtraq mailing list. ... raised when mod_rewrite is dealing with an LDAP URL, ... # Vulnerability discovered by Mark Dowd. ...
      (Securiteam)
    • [NEWS] Apache Multiple Injection Vulnerabilities
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Apache Multiple Injection Vulnerabilities ... Apache is the most widely deployed web server in the Internet. ...
      (Securiteam)
    • [EXPL] Apache Mod_Rewrite Off-by-one Remote Overflow Exploit (win32)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Apache Mod_Rewrite Off-by-one Remote Overflow Exploit ... The Rewrite module for Apache HTTP Server could allow a ... # Vulnerability discovered by Mark Dowd. ...
      (Securiteam)
    • [UNIX] Apache HTTPd Arbitrary Long HTTP Headers DoS
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... The <http://httpd.apache.org/> Apache Software Foundation's HTTP Server ... * Apache web server version 2.0.49, ... It is possible to consume arbitrary amount of memory using a specially ...
      (Securiteam)
    • [EXPL] Apache Multiple Space Header DoS (Multi-Threaded Exploit)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... The exploit code below is another version of the Apache 2.0.52 DoS ... vulnerability published previously here: ... int main(int argc, char **argv){ ...
      (Securiteam)