[33370] in bugtraq
Re: BUG IN APACHE HTTPD SERVER (current version 2.0.47)
daemon@ATHENA.MIT.EDU (=?ISO-8859-15?Q?Andr=E9?= Malo)
Tue Feb 3 23:52:47 2004
Date: Tue, 3 Feb 2004 06:39:33 +0100
From: =?ISO-8859-15?Q?Andr=E9?= Malo <nd@perlig.de>
To: bugtraq@securityfocus.com
Message-Id: <20040203063933.12546429.nd@perlig.de>
In-Reply-To: <20040131211851.30391.qmail@www.securityfocus.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
* Vietnamese Security Group <security@security.com.vn> wrote:
[snakeoil]
> Event if the server does not allow any file parsed (Deny From All),
> the script file fetch.php will still be executed, and it includes
> again and parses any other files in a same directory, which
> indecated by the query variables, to the web client.
Deny from all (in conclusion with some other) denies HTTP access on some
criteria. It doesn't suppose to protect against access from inside the
server.
> I post this issue in the public mailing list, because I think this
> vuln is not exploitable by a remote attacker. If something were
> wrong, drop a line to me.
Next time, try a user support forum first. Thanks.
nd
