On Sunday 26 Apr 2015 01:51:37 Michael Orlitzky wrote: > On 04/25/2015 05:23 PM, Grant wrote: > > I read about this vulnerability in the > > 2015-04-06-apache-addhandler-addtype Gentoo news item. I don't think > > I'm using any functionality that could expose me to the problem but > > I'd like to be able to say so for sure. Does the fact that I'm > > up-to-date with GLSAs, I don't have PHP5 in APACHE2_OPTS (I use > > php-fpm), along with the following (which I think is default) indicate > > that I'm not vulnerable? > > (1) Do you allow untrusted people to upload files to your server? > > (2) If so, do you try to prevent them from uploading PHP files > based on a regular expression or shell glob? > > Unless you answer "yes" to both of those questions, you don't need to > check anything. > > The vulnerability is that with, > > AddHandler application/x-httpd-php .php > > Apache will go ahead and try to execute (for example) foo.php.html. If > you're blocking uploads of *.php to prevent people from uploading PHP > scripts, then I could name my file foo.php.html and bypass your > restriction. > > The AddHandler behavior was documented, but incredibly unexpected -- and > we had it in the default configuration. The new config we ship uses, > > <FilesMatch "\.php$"> > SetHandler application/x-httpd-php > </FilesMatch> > > instead so only *.php files get executed.
Hmm ... I am probably affected by this change too. Running find for '*.php.*' et al, comes up with a tonne of files like this: /var/www/My_Website_Name/htdocs/modules/simpletest/tests/upgrade/drupal-7.filled.minimal.database.php.gz If I were to manually install protection, as suggested in the news item, where should I be doing this? In (umpteen) .htaccess files for each vhost, or somewhere in /etc/apache2/* -- Regards, Mick
signature.asc
Description: This is a digitally signed message part.
