| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <7df124a0512050459k31fe7467n7ade7f47a637890e@mail.gmail.com> Date: Mon Dec 5 12:59:20 2005 From: michael.ligh at mnin.org (Michael Ligh) Subject: Bug with .php extension? I think this is due to Apache's mod_mime_magic: http://httpd.apache.org/docs/1.3/mod/mod_mime_magic.html Lots of phishers are using files named *.php.rar recently. On 12/5/05, Simon Richter <Simon.Richter@...yros.de> wrote: > > Hello, > > Ron wrote: > > > In Apache 1.3.33 (untested on any other version), if you have a file > > called file.php.bak, and you navigate to it in the browser, it will run > > on the server as a .php file. This works with any extension that isn't > > known to the server (.rar, .bak, .test, .java, .cpp, .c, etc.) > > I would think this is related to "Options MultiViews", where a file > generally has many suffixes (file type, language, compression, ...). > Does this also happen to you (yes, I'm too lazy to try right now) if you > turn MultiViews off? > > Nevertheless, good idea that script authors should possibly be aware > that any suffix, not just the last, is interpreted. > > Simon > > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ > > > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20051205/285d7b4f/attachment.html
Powered by blists - more mailing lists