CVE-2002-0661

A remote attacker can send a crafted URL containing `..` sequences with backslashes to traverse directories. This allows the attacker to read arbitrary files on the server. The vulnerability is present in Apache versions 2.0 through 2.0.39 when running on Windows, OS2, or Netware operating systems. The specific payload involves using `..\` sequences to navigate the file system.

The vulnerability resides in the core request handling logic of the Apache HTTP Server, specifically how it processes URLs on Windows, OS2, and Netware platforms. The provided patch removes the `modules/experimental/util_ldap.c` file, which is unrelated to the directory traversal vulnerability described in the CVE.

The patch removes the `modules/experimental/util_ldap.c` file entirely. While the provided patch does not explicitly show the fix for the directory traversal vulnerability, the advisory indicates that Apache 2.0.40 and later versions address this issue by properly sanitizing path components. This prevents the server from interpreting malicious `..` sequences with backslashes as valid directory traversals.