CVE-2011-4963 Details

A vulnerability in nginx for Windows versions 1.3.x prior to 1.3.1 and 1.2.x prior to 1.2.1 allows remote attackers to bypass access restrictions and access restricted files. This is achieved by exploiting Windows' handling of file requests, using either a trailing dot or specific index allocation sequences in the request. The vulnerability arises because nginx did not properly account for all ways files can be accessed on Windows, leading to unauthorized access in scenarios where security restrictions should have been enforced.

Users can upgrade to nginx for Windows versions 1.3.1 or 1.2.1, where this vulnerability has been fixed. For those using older versions, a workaround is to deny requests that include a trailing dot or certain index allocation sequences.