Gönderim Listesi ecs-isp@2rosenthals.com Ar?vli ?leti #363

Gönderen: "Massimo S." <ecs-isp@2rosenthals.com> Tam Ba?l?klar
Çözülmemi? ?leti
Konu: Re: [eCS-ISP] Apache 2.4.49 zero day exploit...
Tarih: Wed, 6 Oct 2021 15:06:37 +0200
Alacak: eCS ISP Mailing List <ecs-isp@2rosenthals.com>

Il 06/10/2021 09:34, Steven Levine ha scritto:
In <list-2633065@2rosenthals.com>, on 10/05/21
    at 10:08 PM, "Roderick Klein" <ecs-isp@2rosenthals.com> said:


It seems this Apache version has a zero day exploit.

This is yet another example of how important it is to understand how to
properly configure httpd or any other server, for that matter.  As the CVE
explains, it takes two errors for the exploit to be effective.  First is
the code defect.  Second is a misconfigured server setup.  There's no
reason to not use "require all denied" except for directories that are
supposed to be accessible and even then the access should be carefully

Many years ago, when I first took over support of the SCOUG sever, I
discovered that the previous webmaster managed to Options +ExecCGI every
directory on the system.  This made for interesting log entries along with
processes that seemed to run for no reason.  Fortunately, this was long
enough ago that there were far fewer script kiddies, so no one tried to
damage the system.


hi all,

about me
i've CGI disabled since years ago

maybe are 10 years that i don't us CGI stuff


Abone ol: Bildirim, Derleme, Fihrist.
Abonelikten ç?k
Liste Sorumlusuna Postala