*) SECURITY: [CAN-2002-0661] Close a very significant security hole that applies only to the Win32, OS2 and Netware platforms. Unix was not affected, Cygwin may be affected. Certain URIs will bypass security and allow users to invoke or access any file depending on the system configuration. Without upgrading, a single .conf change will close the vulnerability. Add the following directive in the global server httpd.conf context before any other Alias or Redirect directives; RedirectMatch 400 "\\\.\." Reported by Auriemma Luigi <bugtest@sitoverde.com>. [Brad Nicholes]
*) SECURITY: Close a path-revealing exposure in multiview type map negotiation (such as the default error documents) where the module would report the full path of the typemapped .var file when multiple documents or no documents could be served based on the mime negotiation. Reported by Auriemma Luigi <bugtest@sitoverde.com>. [CAN-2002-0654] [William Rowe]
*) SECURITY: Close a path-revealing exposure in cgi/cgid when we fail to invoke a script. The modules would report "couldn't create child process /path-to-script/script.pl" revealing the full path of the script. Reported by Jim Race <jrace@qualys.com>. [CAN-2002-0654] [Bill Stoddard]
--- Apache Web Server Directory Traversal and Path Disclosure Vulnerability (non UNIX) -------------------------------------------------------------
SUMMARY
The Apache server (non UNIX) has been found to contain two security vulnerabilities, one a directory traversal vulnerability, the second a path disclosure vulnerability. The first vulnerability allows an attacker to any file in file system and execute it using a prefix of a /cgi-bin/. The second vulnerability is a simple path disclosure bug, useful for obtaining more info about the server (important if the administrator hide some information).
DETAILS
Vulnerable systems: * Apache web server version 2.0.39 and previous 2.0.x (Windows/Netware/OS2)
Immune systems: * Apache web server (UNIX) * Apache web server version 2.0.40 (Windows/Netware/OS2)
Path disclosure: The vulnerability is not dangerous because it does not give remote access to the system or other data accesses but for an attacker it is useful in gathering detailed information about the server to launch other malicious attacks.
HTTPの時はmod_gzipが有効に動作しているのですが、HTTPSだとerror_logに mod_gzip: EMPTY FILE [/tmp/_54463_99_0.wrk] in sendfile2 mod_gzip: Make sure all named directories exist and have the correct permissions. と出てしまい、動いてくれてないようです。