[30311] in bugtraq
Re: Pi3Web 2.0.1 DoS
daemon@ATHENA.MIT.EDU (Holger Zimmermann)
Sun Jun 1 15:18:18 2003
Date: 30 May 2003 09:51:57 -0000
Message-ID: <20030530095157.8371.qmail@www.securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
From: Holger Zimmermann <zimpel@users.sourceforge.net>
To: bugtraq@securityfocus.com
In-Reply-To: <Law8-F81nLOyDc41W2u00004bb6@hotmail.com>
The problem was related to an additional PathInfo="Yes"
parameter in the PathMapper object for the WebRoot
mapping in version 2.0.1.
There is patch available for a longer time, which fixes
this issue in the administration client :
http://sourceforge.net/tracker/download.php?group_id=17753&atid=317753&file_id=47258&aid=718552
Note, that a related issue has been reported for the unix
version of Pi3Web 2.0.1:
http://www.securityfocus.com/archive/1/321177
http://www.securityfocus.com/bid/7555
Follow the information posted there in order to fix the
problem in the configuration.
