Bugtraq mailing list archives

AW: test-cgi

From: atrox () TELEWEB AT (Adrian Dabrowski)
Date: Fri, 15 Jan 1999 01:14:48 +0100


test-cgi should be banned from any system shortly after installation
anyway.

PATH_TRANSLATED can be abused by adding a / or a /~username to test-cgi.
This will give you the real pathname of the htdocs-dir respectively the
real pathname of an users $HOME/public_html.

This info could gain importance to a hacker in combination with some other
bug.

atrox'99

Current thread:

test-cgi - Re: HTTP REQUEST METHOD flaw monti (Jan 13)
- Re: test-cgi - Re: HTTP REQUEST METHOD flaw Peter van Dijk (Jan 14)
  - Re: test-cgi - Re: HTTP REQUEST METHOD flaw Peter van Dijk (Jan 15)
  - Re: test-cgi - Re: HTTP REQUEST METHOD flaw Dr. Mudge (Jan 15)
- Secuity hole with perl (suidperl) and nosuid mounts on Linux Brian McCauley (Jan 14)
  - Re: Secuity hole with perl (suidperl) and nosuid mounts on Linux Jan B. Koum (Jan 15)
    - Re: Secuity hole with perl (suidperl) and nosuid mounts on Linux Ollivier Robert (Jan 18)
    - Re: Secuity hole with perl (suidperl) and nosuid mounts on Linux Jarkko Hietaniemi (Jan 18)
- security hole in Maximizer Mike Jones (Jan 14)
- AW: test-cgi Adrian Dabrowski (Jan 14)