Full Disclosure mailing list archives
Re: FYI: Apache httpd NoFollowSymLink follows symlinks feature
From: Christian Sciberras <uuf6429 () gmail com>
Date: Fri, 24 Jun 2011 17:24:37 +0200
I think you meant "apache follows symlinks even when -FollowSymLinks is *not * set". Otherwise it doesn't seem to make sense? Cheers, Chris. On Fri, Jun 24, 2011 at 5:14 PM, halfdog <me () halfdog net> wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 For those, who did not already know: Due to specification, apache follows symlinks even when -FollowSymLinks is set, when the data is modified concurrently. This can be trivially shown as demonstrated in http://www.halfdog.net/Security/2011/ApacheNoFollowSymlinkTimerace/ . When performing host hardening, do not think, the -FollowSymLinks option alone will prevent you from symlink attacks. - -- http://www.halfdog.net/ PGP: 156A AE98 B91F 0114 FE88 2BD8 C459 9386 feed a bee -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) iD8DBQFOBKnlxFmThv7tq+4RAssHAJ4jiIVCzRLrVFeR6NOXaMSnyOf17ACdEnop yY8Z4UJ9saIxDmDBy/KEZTI= =eNhL -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- FYI: Apache httpd NoFollowSymLink follows symlinks feature halfdog (Jun 24)
- Re: FYI: Apache httpd NoFollowSymLink follows symlinks feature Christian Sciberras (Jun 24)
- Re: FYI: Apache httpd NoFollowSymLink follows symlinks feature halfdog (Jun 24)
- Re: FYI: Apache httpd NoFollowSymLink follows symlinks feature Ferenc Kovacs (Jun 24)
- Re: FYI: Apache httpd NoFollowSymLink follows symlinks feature Christian Sciberras (Jun 24)
- Re: FYI: Apache httpd NoFollowSymLink follows symlinks feature halfdog (Jun 24)
- Re: FYI: Apache httpd NoFollowSymLink follows symlinks feature Ferenc Kovacs (Jun 24)
- Re: FYI: Apache httpd NoFollowSymLink follows symlinks feature Christian Sciberras (Jun 24)