Introduce proper escaping of command.com and cmd.exe for Win32. These patches close vulnerability CAN-2002-0061, identified and reported by Ory Segal <ory.segal@sanctuminc> 13 Feb 2002, by which any invocation of .bat or .cmd files permit system comprimize when cmd.exe parsed the args passed from QUERY_STRING. [William Rowe] Patches of the set reviewed by Allan Edwards and Bill Stoddard, while the security solutions were reviewed at length by the entire security community at the ASF. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@94092 13f79535-47bb-0310-9956-ffa450edef68
Please register or sign in to comment