Quoting "[EMAIL PROTECTED]" <[EMAIL PROTECTED]>:
> > http://www.photopost.com/forum/showthread.php?t=134910 > http://www.photopost.com/forum/showthread.php?p=1213648 > > It's unclear what type of bug is it about, they are refering to an > apache bug but since all hacks used to access the database it could be a > SQL injection. This is critical bug. This is sort of clever, but obvious in hindsight. If a web site has an upload directory that is also readable, it will be vulnerable. Normal sysadmin configurations can prevent this exposure. Upload directories should not be directly viewable. That was the basis for numerous exploits of frontpage systems back in the day. A script should validate the uploaded file and separately move it to a viewable directory. The reason this is an apache bug is because the default install uses an insecure setting for php scripts (perl also). The "AddType" statement for php is normally system-wide, which means the web server will execute php scripts that may be found in the upload directory. This can be fixed multiple ways: Move the php AddType statement into a <directory> stanza, or Set directory options for directories where we would not expect to execute things or use a "AddType" statement in the images directory, like: <Directory /www/htdocs/images> Options +IncludesNoExec -ExecCGI AddType text/html .php <Files ~ "\.php"> Order allow,deny Deny from all </Files> </Directory> that should be redundant enough. tr ------------------------------------------------- Email solutions, MS Exchange alternatives and extrication, security services, systems integration. Contact: [EMAIL PROTECTED] _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
