Re: [cobalt-users] MAJOR BUG, Browse any directory view any file

[Richard Siddall <cobalt@xxxxxxxxxxx>]

ISEE Multimedia wrote:
> A Client of mine has just found out that he can list the contents of
> /home/sites/ giving him a list of all the sites on the server.
>
> Then with 2 lines of code he can view any file on another site on the
> server.
>
> Does anyone have a fix for this!! This is a major security hole for SUN.
>
> Regards
>
> Mark

Mark,

Can you really view any file, or just files that are world-readable? 
(You SHOULD be able to read any file that's world-readable.)

This sounds like something that comes up every couple of years.  Read 
the thread starting:
http://list.cobalt.com/pipermail/cobalt-users/2000-December/029831.html

I believe all *NIX web hosting systems work this way, unless the 
manufacturer goes to great lengths to create virtual dedicated servers. 
 IIRC, three non-Cobalt systems I've used behave this way.  (Just tried 
it on a Windows server, same behaviour.)

Regards,

	Richard.