CVE

Id
1030  
CVE No.
CVE-1999-1050  
Status
Candidate  
Description
Directory traversal vulnerability in Matt Wright FormHandler.cgi script allows remote attackers to read arbitrary files via (1) a .. (dot dot) in the reply_message_attach attachment parameter, or (2) by specifying the filename as a template.  
Phase
Proposed (20010912)  
Votes
ACCEPT(1) Frech | NOOP(3) Cole, Foat, Wall | REVIEWING(1) Christey  
Comments
Christey> Abstraction and definition issue: CD:SF-LOC suggests combining | issues of the same type. Some people refer to "directory | traversal" and just mean .. problems; but there are other | issues (specifying an absolute pathname, using C: drive | letters, doing encodings) that, to my way of thinking, are | "different." Perhaps this should be split. | | My brain hurts too much right now. There are a couple | problems with the references and descriptions of CVE-1999-1050 | and CVE-1999-1051. I"m interpreting the underlying nature | of the problem(s) a little differently than others are. | Some of it may be due to differing definitions or thoughts | about what "directory traversal vulnerabilities" are.  

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
2599 1030 CVE-1999-1050 BUGTRAQ:19991112 FormHandler.cgi  View
2600 1030 CVE-1999-1050 URL:http://www.securityfocus.com/archive/1/34600  View
2601 1030 CVE-1999-1050 BUGTRAQ:19991116 Re: FormHandler.cgi  View
2602 1030 CVE-1999-1050 URL:http://www.securityfocus.com/archive/1/34939  View
2603 1030 CVE-1999-1050 BID:798  View
2604 1030 CVE-1999-1050 URL:http://www.securityfocus.com/bid/798  View
2605 1030 CVE-1999-1050 BID:799  View
2606 1030 CVE-1999-1050 URL:http://www.securityfocus.com/bid/799  View
2607 1030 CVE-1999-1050 XF:formhandler-cgi-absolute-path(3550)  View

Related JVN