[7945] in bugtraq
Re: ColdFusion File Upload Exploit (fwd)
daemon@ATHENA.MIT.EDU (David LeBlanc)
Tue Sep 15 11:40:40 1998
Date: Tue, 15 Sep 1998 09:14:38 -0400
Reply-To: David LeBlanc <dleblanc@MINDSPRING.COM>
From: David LeBlanc <dleblanc@MINDSPRING.COM>
X-To: Aleph One <aleph1@DFW.NET>
To: BUGTRAQ@NETSPACE.ORG
In-Reply-To: <Pine.SUN.4.01.9809142023300.14028-100000@dfw.nationwide.ne t>
At 08:23 PM 9/14/98 -0500, Aleph One wrote:
>---------- Forwarded message ----------
>Date: Mon, 14 Sep 1998 12:12:23 -0600
>From: INFO2000 TECH <colby@INFO2000.NET>
>To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM
>Subject: ColdFusion File Upload Exploit
>
>The following message was posted to the Allaire's COLD FUSION forums:
>
>By default, on Windows NT installations, the CF function, GetTempDirectory
>returns C:\WINNT.
Not quite true (from the API docs):
The GetTempPath function gets the temporary file path as follows:
1. The path specified by the TMP environment variable.
2. The path specified by the TEMP environment variable, if TMP is not
defined.
3. The current directory, if both TMP and TEMP are not defined.
>WORKAROUND: Currently, TEMP is correctly set to C:\TEMP as a User Environment
>Variable, but should also be set as a System Environment Variable.
I agree with this.
David LeBlanc
dleblanc@mindspring.com
