Re: CGI source being exposed using "~"

[phi-vuldev () EXORSUS NET (phi-vuldev () EXORSUS NET)]

Heh. Real simple problem there :)

Unix editors often leave backups as <originalfilename>~, your ISP is
foolish enough to leave these files lying around in their web tree. You're
just downloading the old versions of the scripts since the last edit with
emacs, or vi or joe.

A simple deny for *~ in the Apache config would fix it, preferably paired
with something that regularly goes around deleting ~ files in the web
tree.

Beware that a fair few websites can suffer from this problem. We deny *~
*.old *.bak *.backup etc etc

Phi