Re: Fwd: [Full-disclosure] Thttpd 2.25b Directory Traversal Vulnerability

[Vitezslav Cizek <civ () blema cz>]

* Dne Středa 22. květen 2013, 13:44:09 [CEST] Oden Eriksson napsal:
> onsdagen den 22 maj 2013 13.06.18 skrev  Matthias Weckbecker:
> > Hi,
> >
> > has anybody possibly already confirmed this? It might also be worth
> > to assign a CVE to this if it turns out to be a reproducible issue.
>
> Confirmed here. Needed to use "lynx -dump ...".
Are you sure?
I fail to reproducet the problem.

How do you use lynx?
Do you prepend "http://"; to the url?
Otherwise lynx won't connect over network
and will default to local filesystem.

For example:
$ lynx -dump "google.com:80/../../../../etc/passwd"
wil get you you're local /etc/passwd

  Vita