Secunia Advisory: SA10962 Print Advisory
Release Date: 2004-02-24

Critical: Moderately critical
Impact: Exposure of sensitive information
Where: From remote

Software: Apache 2.0.x, Apache 1.3.x


Description:
Jeremy Bae has reported a vulnerability in Apache running on cygwin, allowing malicious people to view arbitrary files on a vulnerable system.

The problem is that Apache handles "" that are URL encoded incorrectly before a query is sent to the cygwin platform, which interprets backslashes differently than other platforms.

This has been reported to affect Apache 1.3.29 and prior and Apache 2.0.48 and prior running on the cygwin platform. Other platforms are not known to be affected.

Solution:
A patch has been published for Apache 1.3.29:
http://nagoya.apache.org/bugzilla/showattachment.cgi?attach_id=10222

Provided and/or discovered by:
Jeremy Bae, STG Security.

Original Advisory:
http://nagoya.apache.org/bugzilla/show_bug.cgi?id=26152

Source: Secunia

OS/2-eCS-ArcaOS General News

More in General  

OS/2-eCS-ArcaOS Software News

More in Software  

Latest Forum Posts

WarpStock and OS/2-eCS-ArcaOS Event News

More in Events  

Site News

More in Site News