Re: [Full-disclosure] FYI: Apache httpd NoFollowSymLink follows symlinks feature

[Ferenc Kovacs <tyra3l@xxxxxxxxx>]

> The
>>
> FAQ says: "You can usually avoid problems by either finding the
> Options directive that already applies to a specific directory and
> changing it, or by putting your Options directive inside the most
> specific possible <Directory> section."
>
> The option is in the most specific directory section and it also takes
> effect, returning forbidden on http request. But when you use the
> RenameLoop program in parallel, it fails to detect the symlink and
> delivers the linked data. This specific TOCTOU issue is known and part
> of the apache specification.
>

I didn't mean to imply otherwise, I've just explained what does the
+/- before an option does.

Tyrael

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/