full-disclosure - Re: FYI: Apache httpd NoFollowSymLink follows symlinks feature

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 24 Jun 2011 17:50:29 +0000
From: halfdog <me@...fdog.net>
To: Ferenc Kovacs <tyra3l@...il.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: FYI: Apache httpd NoFollowSymLink follows
 symlinks feature

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Ferenc Kovacs wrote:
> On Fri, Jun 24, 2011 at 5:24 PM, Christian
> Sciberras<uuf6429@...il.com>  wrote:
>> I think you meant "apache follows symlinks even when
>> -FollowSymLinks is not set". Otherwise it doesn't seem to make
>> sense?
> 
> -FollowSymLinks turns off the FollowSymLinks option without
> resetting the other Options. 
> http://wiki.apache.org/httpd/FAQ#Why_do_my_Options_directives_not_have_the_desired_effect.

The
> 
FAQ says: "You can usually avoid problems by either finding the
Options directive that already applies to a specific directory and
changing it, or by putting your Options directive inside the most
specific possible <Directory> section."

The option is in the most specific directory section and it also takes
effect, returning forbidden on http request. But when you use the
RenameLoop program in parallel, it fails to detect the symlink and
delivers the linked data. This specific TOCTOU issue is known and part
of the apache specification.

- -- 
http://www.halfdog.net/
PGP: 156A AE98 B91F 0114 FE88  2BD8 C459 9386 feed a bee
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFOBM5jxFmThv7tq+4RAoLbAJ9JUlpXxGM6vXOBIP7fQZgVphdn+wCcDv8O
Hu4gjjxAONZm6KU8vrTE+m8=
=L1O7
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/