[SECURITY-PATCH] cygwin: Apache 1.3.29 and below directory traversal vulnerability

2004-02-04 Thread Stipe Tolj
Hi list, attached patch fixes the bug# 26152 as described in http://nagoya.apache.org/bugzilla/show_bug.cgi?id=26152 Main purpose was to handle backslashes in the URI to avoid misleading interpretation via the underlying cygwin OS layer, which allows backslashes as directory delimiters.

Re: [SECURITY-PATCH] cygwin: Apache 1.3.29 and below directory traversal vulnerability

2004-02-04 Thread Martin Kraemer
On Wed, Feb 04, 2004 at 05:48:48PM +0100, Stipe Tolj wrote: Hi list, attached patch fixes the bug# 26152 as described in http://nagoya.apache.org/bugzilla/show_bug.cgi?id=26152 Main purpose was to handle backslashes in the URI to avoid misleading interpretation via the underlying cygwin

Re: [SECURITY-PATCH] cygwin: Apache 1.3.29 and below directory traversal vulnerability

2004-02-04 Thread Roy T. Fielding
-1. Reject the request with a 400 error instead. Roy

Re: [SECURITY-PATCH] cygwin: Apache 1.3.29 and below directory traversal vulnerability

2004-02-04 Thread William A. Rowe, Jr.
At 05:45 PM 2/4/2004, Roy T. Fielding wrote: -1. Reject the request with a 400 error instead. ++1 to Roy's suggestion. I believe that Win32 may accept the back slash (with the changes proposed for the cygwin port.) However ... here's the trick ... the cygwin httpd port is emulating Unix, so it

Re: [SECURITY-PATCH] cygwin: Apache 1.3.29 and below directory traversal vulnerability

2004-02-04 Thread Stipe Tolj
Hi Roy, Roy T. Fielding wrote -1. Reject the request with a 400 error instead. actually a standard (apache layout) install (from source) on a linux box with the URI described in the bug report gives also a 404, and *not* a 400 in response. So we get the same behaviour on cygwin as on

Re: [SECURITY-PATCH] cygwin: Apache 1.3.29 and below directory traversal vulnerability

2004-02-04 Thread Stipe Tolj
William A. Rowe, Jr. wrote: At 05:45 PM 2/4/2004, Roy T. Fielding wrote: -1. Reject the request with a 400 error instead. ++1 to Roy's suggestion. I believe that Win32 may accept the back slash (with the changes proposed for the cygwin port.) However ... here's the trick ... the

Re: [SECURITY-PATCH] cygwin: Apache 1.3.29 and below directory traversal vulnerability

2004-02-04 Thread Stipe Tolj
Stipe Tolj wrote: Hi Roy, Roy T. Fielding wrote -1. Reject the request with a 400 error instead. actually a standard (apache layout) install (from source) on a linux box with the URI described in the bug report gives also a 404, and *not* a 400 in response. So we get the same