www-apache-bugdb mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Matthias Schmitz <hunte...@gmx.li>
Subject general/7866: every cgi script can read out the files with read access for all
Date Wed, 13 Jun 2001 20:29:17 GMT

>Number:         7866
>Category:       general
>Synopsis:       every cgi script can read out the files with read access for all
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    apache
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   apache
>Arrival-Date:   Wed Jun 13 13:30:03 PDT 2001
>Closed-Date:
>Last-Modified:
>Originator:     hunter23@gmx.li
>Release:        all with perl support
>Organization:
apache
>Environment:
every operating system (more critical in winnt/2k)
>Description:
i found no possibility than to run apache manual in a chroot'ed environment or to set the
access level for all files and folders to no read/write/execute rights expecting the files
i want to have public accessable in order to prevent to give cgi scripts the possibility in
reading out all files with the right read for all users.
>How-To-Repeat:
http://www.hunter23.f2s.com/files.cgi and http://h23.netfirms.com/cgi-bin/files.cgi
here is a script that allows to read out nearly all files from the f2s freespace provider
and netfirms, that means all cgi scripts from other users, password files from boards etc.
>Fix:
1. a possibility to run apache in a chroot'ed environment like many ftpds offer
2. the apache would read out .htaccess files also for perl scripts, trying to read out files/folders
3. possibilitiy to set also the rights for folders for cgi scripts (directory directive)
>Release-Note:
>Audit-Trail:
>Unformatted:
 [In order for any reply to be added to the PR database, you need]
 [to include <apbugs@Apache.Org> in the Cc line and make sure the]
 [subject line starts with the report component and number, with ]
 [or without any 'Re:' prefixes (such as "general/1098:" or      ]
 ["Re: general/1098:").  If the subject doesn't match this       ]
 [pattern, your message will be misfiled and ignored.  The       ]
 ["apbugs" address is not added to the Cc line of messages from  ]
 [the database automatically because of the potential for mail   ]
 [loops.  If you do not include this Cc, your reply may be ig-   ]
 [nored unless you are responding to an explicit request from a  ]
 [developer.  Reply only with text; DO NOT SEND ATTACHMENTS!     ]
 
 


Mime
View raw message