Received: (qmail 11690 invoked by uid 501); 31 Jan 2002 07:15:23 -0000 Message-Id: <20020131071523.11689.qmail@apache.org> Date: 31 Jan 2002 07:15:23 -0000 From: Dave Yadallee Reply-To: root@nk.ca To: submit@bugz.apache.org Subject: cgi-bin scripts security violation X-Send-Pr-Version: 3.110 >Number: 9661 >Category: os-bsdi >Synopsis: cgi-bin scripts security violation >Confidential: no >Severity: non-critical >Priority: medium >Responsible: apache >State: closed >Quarter: >Keywords: >Date-Required: >Class: mistaken >Submitter-Id: apache >Arrival-Date: Wed Jan 30 23:20:00 PST 2002 >Closed-Date: Wed Jan 30 23:22:56 PST 2002 >Last-Modified: Wed Jan 30 23:22:56 PST 2002 >Originator: root@nk.ca >Release: 1.3.23 >Organization: >Environment: BSD/OS doctor.nl2k.ab.ca 4.2 BSDI BSD/OS 4.2 Kernel #91: Sat Jan 12 12:27:23 MST 2002 root@doctor.nl2k.ab.ca:/usr/src/sys/compile/LOCAL i386 >Description: Please check http://www.nk.ca/usage . We noticed someone trying to hack into the cgi-bin script directory >How-To-Repeat: http://www.nk.ca/cgi-bin >Fix: Chomd 0755 or Security patch? >Release-Note: >Audit-Trail: State-Changed-From-To: open-closed State-Changed-By: marc State-Changed-When: Wed Jan 30 23:22:55 PST 2002 State-Changed-Why: [This is a standard response.] This is a CGI programming or basic configuration issue. As mentioned on the main bug database page, we must refer all such basic or non-Apache-related questions to the user newsgroups comp.infosystems.www.servers.unix and comp.infosystems.www.servers.ms-windows, or the scripting newsgroup comp.infosystems.www.authoring.cgi First check the FAQ http://httpd.apache.org/docs/misc/FAQ.html and then pose your question to the appropriate newsgroup. Thanks for using Apache! Class-Changed-From-To: sw-bug-mistaken Class-Changed-By: marc Class-Changed-When: Wed Jan 30 23:22:55 PST 2002 Severity-Changed-From-To: critical-non-critical Severity-Changed-By: marc Severity-Changed-When: Wed Jan 30 23:22:55 PST 2002 >Unformatted: [In order for any reply to be added to the PR database, you need] [to include in the Cc line and make sure the] [subject line starts with the report component and number, with ] [or without any 'Re:' prefixes (such as "general/1098:" or ] ["Re: general/1098:"). If the subject doesn't match this ] [pattern, your message will be misfiled and ignored. The ] ["apbugs" address is not added to the Cc line of messages from ] [the database automatically because of the potential for mail ] [loops. If you do not include this Cc, your reply may be ig- ] [nored unless you are responding to an explicit request from a ] [developer. Reply only with text; DO NOT SEND ATTACHMENTS! ]