bugtraq - Re: BUG IN APACHE HTTPD SERVER (current version 2.0.47)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20040203063933.12546429.nd@perlig.de>
Date: Tue, 3 Feb 2004 06:39:33 +0100
From: André Malo <nd@...lig.de>
To: bugtraq@...urityfocus.com
Subject: Re: BUG IN APACHE HTTPD SERVER (current version 2.0.47)


* Vietnamese Security Group <security@...urity.com.vn> wrote:

[snakeoil]

> Event if the server does not allow any file parsed (Deny From All), 
> the script file fetch.php will still be executed, and it includes 
> again and parses any other files in a same directory, which 
> indecated by the query variables, to the web client. 

Deny from all (in conclusion with some other) denies HTTP access on some
criteria. It doesn't suppose to protect against access from inside the
server.


> I post this issue in the public mailing list, because I think this 
> vuln is not exploitable by a remote attacker. If something were 
> wrong, drop a line to me.

Next time, try a user support forum first. Thanks.

nd