Re: [Full-disclosure] FYI: Apache httpd NoFollowSymLink follows symlinks feature



The

FAQ says: "You can usually avoid problems by either finding the
Options directive that already applies to a specific directory and
changing it, or by putting your Options directive inside the most
specific possible <Directory> section."

The option is in the most specific directory section and it also takes
effect, returning forbidden on http request. But when you use the
RenameLoop program in parallel, it fails to detect the symlink and
delivers the linked data. This specific TOCTOU issue is known and part
of the apache specification.


I didn't mean to imply otherwise, I've just explained what does the
+/- before an option does.

Tyrael

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/