[33703] in bugtraq
Re: Apache Http Server Reveals Script Source Code to Remote Users
daemon@ATHENA.MIT.EDU (=?ISO-8859-15?Q?Andr=E9?= Malo)
Fri Feb 13 17:25:16 2004
Date: Thu, 12 Feb 2004 22:46:30 +0100
From: =?ISO-8859-15?Q?Andr=E9?= Malo <nd@perlig.de>
To: bugtraq@securityfocus.com, security@httpd.apache.org
Message-Id: <20040212224630.4ef63f6c.nd@perlig.de>
In-Reply-To: <6027.1076610355@www41.gmx.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
* "Oliver Schneider" <Borbarad@gmxpro.net> wrote:
> > Right. On Unix "WEB-INF" and "WEB-INF.." are two different, legal file
> > names. On Windows, trailing dots seem to be ignored, so "WEB-INF" and
> > "WEB-INF.." are just two names for the same file. This also works if the
> > filename already has an extension, so for example "foo.html" and
> > "foo.html....." are the same file, too. I wonder whether that can be
> > exploited, too: Get the contents of a CGI script by requesting
> > "foo.cgi."?
> I checked it on our Windows 2000 Server running Apache 2.0.48, it didn't
> work for the .pl-scripts.
> I.e. "download.pl." instead of "download.pl" gave the output of the actual
> script.
In fact, I could not find any situation running pure apache where it occurs.
So I suspect the problem occurs only with the foreign resin handler which
seems to do its own mapping :-(
nd
