Description
Jigsaw 2.2.1 on Windows systems allows remote attackers to use MS-DOS device names in HTTP requests to (1) cause a denial of service using the "con" device, or (2) obtain the physical path of the server using two requests to the "aux" device.
References
- 5258 vdb-entry
- jigsaw-dos-device-dos(9587) vdb-entry
- 20020717 KPMG-2002031: Jigsaw Webserver Path Disclosure mailing-list
- 20020717 KPMG-2002034: Jigsaw Webserver DOS device DoS mailing-list
- jigsaw-aux-path-disclosure(9586) vdb-entry
- 20020717 [VulnWatch] KPMG-2002034: Jigsaw Webserver DOS device DoS mailing-list
- 5251 vdb-entry
- 20020717 [VulnWatch] KPMG-2002031: Jigsaw Webserver Path Disclosure mailing-list