Bajie is a freeware HTTP daemon written in Java has vulnerabilities which allow remote users to view any file on the system, and find out the real server path.
bb0152854b73ba34c57a2533b63ba1faaf12153332b4f4aad09a36c44a8d4d19
More junk brought to you by the MDMA Crew <www.mdma.za.net>
Two security flaws in the Bajie Webserver
Bajie is a freeware HTTP daemon written in Java and available from TuCows. We
found two vulnerabilities in it...
The sample Java servlet at /servlet/test/pathInfo/test gives away a real path
(eg. /www/html or c:\wwwroot or whatever). This information could be of use to
a cracker and should not be readily available.
By requesting four trailing dots (http://blah/....), the server throws you
directly into the root directory. This allows you to read any file on the same
drive as the server's HTML if Bajie is running under Windoze, or, under Unix,
any file, period. :)
Okay. That's all then. Eat your parents. Give Wizdumb all your money.
Cheers,
Andrew