Re: htaccess with apache

["Sverre H. Huseby" <shh () thathost com>]

[A.D.Douma]

|   My question is what else could an attacker do? Would command
|   execution be possible?

Sometimes.  If the code looks somewhat like this:

    # first get $filename from the arguments.  then:
    open(F, $filename);

the attacker could make sure $filename was represented as eg:

    find / -ls |

Note the trailing bar, which instructs Perl to open a pipe from the
given command.  One should explicitely tell Perl to open a _file_ for
reading:

    open(F, "<" . $filename);

In addition, one should of course make sure the filename contains only
reasonable characters.


Sverre.

-- 
shh () thathost com
http://shh.thathost.com/