bugtraq - A little advisory content correction.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20070918200505.23456.qmail@securityfocus.com>
Date: 18 Sep 2007 20:05:05 -0000
From: j00ru.vx@...il.com
To: bugtraq@...urityfocus.com
Subject: A little advisory content correction.

There is a small mistake in the line:

readme.txt /../../../../../../../../asdf.exe

This filename originally looks like:

readme.txt <40 spaces here> /../../../../../../../../asdf.exe 

What I mean, is that only the "readme.txt" part of path is visible for the user, and the directory traversal string can be easily hidden in this way.
The forty space characters aren't displayed correctly due to the fact that they are shortened to one space by the browser. 

j00ru