[Xitami] Security Issue - Disabling Script Processing

[TW]

At 12:39 14.01.2003 -0700, you wrote:
>No, This log file excerpt was indeed created by Xitami.  I just stripped off
>the front of the error strings for brevity.  I have long since moved away
>from that IIS crap.
>
>Your assertion that Xitami is not affected by "it" would be incorrect.  In
>addition, the Win2K system that I have has ALL recent updates and security
>patches applied.

Well, very interesting.

Tested your problem here (Win2k SP2, no IIS installed; Xitami 2.4d9 - 
almost default setup), that is, used the query string from your logfile and 
a number of similar querystrings (known to be IIS explores) from security 
related list and found 404 on every try.

Regarding Ewen's comment on this issue, I didn't even get an 
'oops-dunno_what_to_do-200', it was 404 always.

This is what I expect, I can't produce any breakout of the dedicated 
web-directories.
Actually I can't even imagine to happen the same on Xitami, because 
URL-checking regarding allowed paths (including dot-dot attacks) is a 
default exercise for a webserver, and a bogus version went into the 
productive IIS only by bad luck (or you might say M$-chaos).

Anyway, if I were able to reproduce the problem, I'd spend some brain power 
on it, but I can't.

Tony