# Security advisory

**URL:** <https://www.ruby-forum.com/t/security-advisory/220296>\
**Category:** NGINX\
**Created:** [June 5, 2012, 4:33pm UTC](https://www.ruby-forum.com/t/security-advisory/220296 "2012-06-05T16:33:36Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Gurdipe\_D](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/b77776/32.png) [@Gurdipe\_D](https://www.ruby-forum.com/u/Gurdipe_D)\
**Post date:** [June 5, 2012, 4:33pm UTC](https://www.ruby-forum.com/t/security-advisory/220296/1 "2012-06-05T16:33:36Z")

</div>

Hello!

Vladimir Kochetkov, Positive Research Center, discovered a  
security problem in nginx/Windows, which might allow security  
restrictions bypass (CVE-2011-4963).

There are many ways to access the same file when working under  
Windows, and nginx failed to account for all of them. As a  
result, it was possible to bypass security restrictions like

```
location /directory/ {
    deny all;
}

```

by requesting a file as “/directory::$index\_allocation/file”, or  
“/directory:$i30:$index\_allocation/file”, or “/directory./file”.

The problem is fixed in nginx/Windows 1.3.1, 1.2.1.

For older versions the following configuration can be used as a  
workaround:

```
location ~ "(\./|:\$)" {
    deny all;
}

```

Maxim D.