Date: Thu, 6 May 1999 23:51:27 +0200
From: Arne Vidstrom <winnt@BAHNHOF.SE>
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM
Subject: ".."-hole in Alibaba 2.0

Hi,

I've found a security hole in the web server Alibaba 2.0 (the latest
version). I haven't tried it on any other version. Here's an example:

If you install it so the web root is located in c:\alibaba\HtmlDocs\ you
can send an URL:

http://www.server.se/../../winnt/file.txt

and get the "file.txt" file. This works all over the disk Alibaba is
installed on. If directory browsing isn't allowed you have to know the
pathname of the file you want. If directory browsing is allowed you can
start at the disk root directory, but you have to enter the directories by
hand when browsing, because the server will assume they are located in the
web root, so if you just click around all you'll get is lots of 404's.

/Arne Vidstrom


- comment for Russ to be removed when posting out on the list -

I haven't contacted the vendor at all.

- end of comment -