Bugtraq: Re: BUG IN APACHE HTTPD SERVER (current version 2.0.47)

[André Malo <nd () perlig de>]

* Vietnamese Security Group <security () security com vn> wrote:

[snakeoil]

> Event if the server does not allow any file parsed (Deny From All), 
> the script file fetch.php will still be executed, and it includes 
> again and parses any other files in a same directory, which 
> indecated by the query variables, to the web client. 
Deny from all (in conclusion with some other) denies HTTP access on some
criteria. It doesn't suppose to protect against access from inside the
server.


> I post this issue in the public mailing list, because I think this 
> vuln is not exploitable by a remote attacker. If something were 
> wrong, drop a line to me.
Next time, try a user support forum first. Thanks.

nd