Zeus has discovered a serious security bug in the Content Negotiation feature of Zeus Web Server in versions prior to 4.3r3.

This document describes the scope of the problem and its solution.

ZWS 4.3r3 was released on Friday 16th June 2006 via customers' download pages and for evaluation.

Before you attempt to do this you should first make yourself familiar with both MS FrontPage and chrooting simple CGI scripts.

When you chroot a CGI script, there is absolutely no way it can access files outside the chroot 'jail' you limit it to. This has security benefits, but it also means that it cannot access any libraries or configuration files that are outside of this jail directory.

On HP-UX, userspace utilities such as top or ps report that ZWS is running as root even though it has been configured to run as different user.