bajie.webserver.txt

`More junk brought to you by the MDMA Crew <www.mdma.za.net>  
Two security flaws in the Bajie Webserver  
  
Bajie is a freeware HTTP daemon written in Java and available from TuCows. We  
found two vulnerabilities in it...  
  
The sample Java servlet at /servlet/test/pathInfo/test gives away a real path  
(eg. /www/html or c:\wwwroot or whatever). This information could be of use to  
a cracker and should not be readily available.  
  
By requesting four trailing dots (http://blah/....), the server throws you  
directly into the root directory. This allows you to read any file on the same  
drive as the server's HTML if Bajie is running under Windoze, or, under Unix,  
any file, period. :)  
  
Okay. That's all then. Eat your parents. Give Wizdumb all your money.  
  
Cheers,  
Andrew  
  
`