Vulnerability Development mailing list archives

Re: CGI source being exposed using "~"


From: crlf () SYMPATICO CA (Mike Waychison)
Date: Tue, 9 May 2000 04:56:22 -0400


<Files ~ "\~$">
    Order allow,deny
    Deny from all
</Files>

is what you are looking for

Mike Waychison

Andrew Reisse said:

<On my servers, I put a section like this in httpd.conf to prevent editor
<backups from being read (which, as you said, might contain passwords or
<other interesting data)

<Files ~ "^\~">
   Order allow,deny
   Deny from all
</Files>

I have tried adding that to a couple of apache servers with no luck. The
source is still being displayed. as suggested by a friend i even tried:

<Files ~ "^\.cgi.$">
   Order allow,deny
   Deny from all
</Files>

for blocking files like cgi.text and cgi.bak. I still got the same results.
is there something im missing?

Thanks in advance

Brian



Current thread: