Bugtraq mailing list archives

The old "." problem


From: nblasgen () NICK REFRACT COM (nblasgen () NICK REFRACT COM)
Date: Wed, 13 Oct 1999 15:31:02 -0700


A while back there was the problem of Windows HTTP servers with CGI and
other sever parsed pages (ASF, SMX, etc) if you added a "." to the end it
would give you the raw code in TEXT format.  I understand how that was a
security problem.

Just noticed that the same problem is true for at least one Windows FTP
server, Serv-U.  I can't find a problem with being able to request files
with a extra "." at the end.  I was unable to test the idea of downloading
files that I had no permissions too.

Nicholas Blasgen
Refract, LLC


Current thread: