Sign up for the ITPro Today newsletter
Stay on top of the IT universe with commentary, news analysis, how-to's, and tips delivered to your inbox daily.
AnalogX Directory Traversal
impleServer adequately protects against directorytraversal when attempted via the typical dot dot slash (../) syntax.
ITPro Today Staff
July 27, 2000
1 Min Read
Reported July 31, 2000 byFoundstone
VERSIONS AFFECTED
SimpleServer 1.06DESCRIPTION
SimpleServer adequately protects against directorytraversal when attempted via the typical dot dot slash (../) syntax. However, if the ASCIIcharacters for the dots are replaced with their hexidecimal equivalent (%2E) thendirectory traversal can succeed.
DEMONSTRATION
http://TestWebServer/%2E%2E/filename.ext
VENDOR RESPONSE
AnalogX released an updated version 1.07 of the product, whichcorrects the vulnerability.
CREDIT
Discovered by Foundstone
About the Author
You May Also Like
.jpg?width=700&auto=webp&quality=80&disable=upscale)
