Bugtraq mailing list archives
Re: Apache 1.3.27 mod_proxy security issue
From: Joshua Slive <joshua () slive ca>
Date: Tue, 29 Jul 2003 17:01:06 -0400 (Est (heure d'été))
On Tue, 29 Jul 2003, William A. Rowe, Jr. wrote:
At 12:31 PM 7/23/2003, Greg A. Woods wrote:I don't know how clients are matched against domains in ACL statements such as the above in Apache, but I will note that it is NEVER safe to rely on the Reverse DNS alone to implement ACLs that affect the ability of a random remote client system.On this point, too, it would be valuable to provide an example subnet as a preferable alternative to reverse DNS queries. That change has not been made yet - but is referred to our documentation project.
Apache does double-reverse lookups to assure that nothing too funky is going on, so using dns names is relatively safe. It is still better to use an IP subnet for performance reasons, but the hostname may be easier to understand as an example. Joshua.
Current thread:
- Re: Apache 1.3.27 mod_proxy security issue Michael Shigorin (Jul 30)
- Re: Apache 1.3.27 mod_proxy security issue William A. Rowe, Jr. (Jul 30)
- Re: Apache 1.3.27 mod_proxy security issue Joshua Slive (Jul 30)
- Re: Apache 1.3.27 mod_proxy security issue William A. Rowe, Jr. (Jul 30)