Bugtraq mailing list archives
Re: [Full-disclosure] Apache suEXEC privilege elevation / information disclosure
From: Michal Zalewski <lcamtuf () coredump cx>
Date: Sun, 11 Aug 2013 07:52:05 -0700
for doing this features in httpd.conf you can use AllowOverride None instead of AllowOverride all
AllowSymlinks is a red herring here (hardlinks should do, unless you have stuff partitioned in a very thoughtful way, which most don't), similarly to suexec. In general, sharing web hosting providers that allow shell access or scripting are pretty much boned in a myriad of ways. /mz
Current thread:
- Apache suEXEC privilege elevation / information disclosure king cope (Aug 07)
- Message not available
- Re: [Full-disclosure] Apache suEXEC privilege elevation / information disclosure king cope (Aug 07)
- Message not available
- Re: [Full-disclosure] Apache suEXEC privilege elevation / information disclosure Michal Zalewski (Aug 11)
- Re: [Full-disclosure] Apache suEXEC privilege elevation / information disclosure Tobias Kreidl (Aug 11)
- Re: [Full-disclosure] Apache suEXEC privilege elevation / information disclosure king cope (Aug 07)
- Message not available
- Re: Apache suEXEC privilege elevation / information disclosure Kingcope (Aug 09)
- RE: [Full-disclosure] Apache suEXEC privilege elevation / Dico Emil (Aug 09)
- Message not available
- Re: [Full-disclosure] Apache suEXEC privilege elevation / information disclosure Gichuki John Chuksjonia (Aug 10)
- Re: [Full-disclosure] Apache suEXEC privilege elevation / information disclosure Jeffrey Walton (Aug 10)
- Re: [Full-disclosure] Apache suEXEC privilege elevation / information disclosure Reindl Harald (Aug 10)
- Re: [Full-disclosure] Apache suEXEC privilege elevation / information disclosure terry white (Aug 11)