Re: security bug in Apache regarding SSI and symbolic links?

Nick Kew <nick@xxxxxxxxxxxx> · Sat, 15 Nov 2008 11:16:34 +0000

On 15 Nov 2008, at 03:54, Paul B. Henson wrote:

Last month I had a problem where SSI appeared to be ignoring the

SymlinkIfOwnerMatch configuration directive. I opened a bug, and  

eventually

discovered what appears to be a problem in the ap_directory_walk  

function,

where reusing cached directory information bypasses the symbolic link
check.

	https://issues.apache.org/bugzilla/show_bug.cgi?id=45959

I haven't time to follow up on that just now, but that looks like a  

duplicate

of a recently-fixed bug.

Note to self: do follow this up.

--
Nick Kew

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@xxxxxxxxxxxxxxxx
  "   from the digest: users-digest-unsubscribe@xxxxxxxxxxxxxxxx
For additional commands, e-mail: users-help@xxxxxxxxxxxxxxxx