Re: Another flaw in Apache?

[Michal Zalewski <lcamtuf () coredump cx>]

On Sun, 23 Jun 2002, Alexander Yurchenko wrote:

> Nice bug and easy to exploit. I've attached a piece of code which
> creates an .htaccess file. Requesting a directory containing this file
> causes all httpd daemons to die. Works on my OpenBSD 3.1-current.

Check out what you get - file descriptors and other goodies - and perhaps
it is a good time to cc: bugtraq or at least Apache guys?;-)

Have fun,
-- 
_____________________________________________________
Michal Zalewski [lcamtuf () bos bindview com] [security]
[http://lcamtuf.coredump.cx] <=-=> bash$ :(){ :|:&};:
=-=> Did you know that clones never use mirrors? <=-=
          http://lcamtuf.coredump.cx/photo/