OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Bugtraq archives for 2nd quarter (Apr-Jun) 1999: Re: An issue with Apache on Debian

Re: An issue with Apache on Debian

Karellen (karellenCRYOGEN.COM)
Fri, 9 Apr 1999 00:48:14 +0300 

On Mon, Apr 05, 1999 at 07:53:35PM +0300, Andrei D. Caraman wrote:
> That would allow any user from the net (malicious or not) to know the
> exact version of the software packages installed on a Debian box.  It

That reminds me of something else. On Debian 2.0, after I read the Apache
manual I tried that neat example they suggest 'ln -s / ~/public_html'
lynx http://localhost/~username -- I actually got to see my root directory!
Any user with shell acess could do this and allow people browse through your
/etc, /home and what not. To fix this, add the following lines to the top of
your /etc/apache/apache.conf.

<Directory />
AllowOverride None
Options None
Order deny,allow
Deny from all
</Directory>

I had someone confirm this for me, and I got a positive answer.
The package maintainer has been notified. I am using v1.3.3-4.