-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
IronWall webserver 7.41 directory traversal
[-
App: IronWall Webserver
Version: 7.41 estable (others not tested)
Platform: win32
Ironwall webserver is a small web server for win32 systems.
It can be downloaded totally free at softonic/tucows, and their devels seems to be out of order.
1.- If its installed with default options, it shows any file in any drive of the computer where is installed,
because there is no root path already defined.
Sample:
http://www.server.com/path/to/file.ext
This is not a bug, but it's a big security problem.
2.- When root path is defined, you still have access to full drives. Just add 3 or more dots (…) as path
in the url. This set the drive where installed as root path, and gives access to every files.
Sample:
http://www.server.com/...../path/to/file.ext
Vendor was notified on 2005-12-08 without answer.
note: softonic at 03/09/2005 (19.886 downloads), 2nd pos sorted by downloads.
thanks to make-bzimage.net *
M4ntr4… we known your're reading it!. *
zdump (at) make-bzimage (dot) net
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org
iD8DBQFDxGTcICM1ozzFv7sRAg2UAKCARky1hT/z0hlrOYtI7oHmQGWqyQCfXCSG
oxbVdYiRv1cGSDZieXCwUqg=
=pM7s
-----END PGP SIGNATURE-----
–
hwclock (at) gmail (dot) com
GPG ID: 0x3CC5BFBB
GPG Srv: pgp.rediris.es