alibaba.2.0.txt

`Date: Thu, 6 May 1999 23:51:27 +0200  
From: Arne Vidstrom <[email protected]>  
To: [email protected]  
Subject: ".."-hole in Alibaba 2.0  
  
Hi,  
  
I've found a security hole in the web server Alibaba 2.0 (the latest  
version). I haven't tried it on any other version. Here's an example:  
  
If you install it so the web root is located in c:\alibaba\HtmlDocs\ you  
can send an URL:  
  
http://www.server.se/../../winnt/file.txt  
  
and get the "file.txt" file. This works all over the disk Alibaba is  
installed on. If directory browsing isn't allowed you have to know the  
pathname of the file you want. If directory browsing is allowed you can  
start at the disk root directory, but you have to enter the directories by  
hand when browsing, because the server will assume they are located in the  
web root, so if you just click around all you'll get is lots of 404's.  
  
/Arne Vidstrom  
  
  
- comment for Russ to be removed when posting out on the list -  
  
I haven't contacted the vendor at all.  
  
- end of comment -  
  
`