Two security flaws in Bajie Webserver

[labs () MDMA ZA NET]

More junk brought to you by the MDMA Crew <www.mdma.za.net>
Two security flaws in the Bajie Webserver

Bajie is a freeware HTTP daemon written in Java and available from TuCows. We
found two vulnerabilities in it...

The sample Java servlet at /servlet/test/pathInfo/test gives away a real path
(eg. /www/html or c:\wwwroot or whatever). This information could be of use to
a cracker and should not be readily available.

By requesting four trailing dots (http://blah/....), the server throws you
directly into the root directory. This allows you to read any file on the same
drive as the server's HTML if Bajie is running under Windoze, or, under Unix,
any file, period. :)

Okay. That's all then. Eat your parents. Give Wizdumb all your money.

Cheers,
Andrew