tdhttp transversal bug

[UkR-XblP <cuctema () OK RU>]

-=-=-=-=-=[ UkR security team - advisory n0. 7 ]=-=-=-=-=-
tdhttp transversal bug
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Date: 07.02.2001

Problem: possibility of arbitrary file retreival
and directory listing on remote host, running
tdhttp (http.c, probably all its versions).

Workaround: try another http daemon (Apache, for ex.) and
disable http service 'till that time.

Comment: duh. I wonder if I can see /etc/passwd right in my
IE
window. No matter it's only beta version, I mean http.c.
After all, this bug is well-known.

Authors: XblP, S1LENCE

Example:
http://www.timduff.com/../../../../../../../../../../etc/passwd
http://www.timduff.com/../../../../../../../../../../root/
Get your free e-mail address at http://www.zmail.ru