Bug#517377: marked as done (apache 1.3 shows perl script source in iphone-browser)
Your message dated Wed, 9 Sep 2009 12:31:44 +0200
with message-id <20090909103144.GA27877@benz.df7cb.de>
and subject line Re: Bug#517377: apache 1.3 shows perl script source in iphone-browser
has caused the Debian Bug report #517377,
regarding apache 1.3 shows perl script source in iphone-browser
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)
--
517377: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=517377
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems
--- Begin Message ---
Package: apache
Version: 1.3.34-4.1+etch1
Severity: grave
When a script called "index.cgi" is the directory-index in apache 1.3
and this script is accessed using the iphone browser, apache shows the
script source of the perl script, even if the perl script is correctly
being executed when accessed with any other browser.
This might expose passwords and might be a severe security issue.
I am using Debian GNU/Linux 4.0 Etch, kernel 2.6.18-6-vserver-686
--- End Message ---
--- Begin Message ---
- To: 517377-done@bugs.debian.org
- Subject: Re: Bug#517377: apache 1.3 shows perl script source in iphone-browser
- From: Christoph Berg <myon@debian.org>
- Date: Wed, 9 Sep 2009 12:31:44 +0200
- Message-id: <20090909103144.GA27877@benz.df7cb.de>
- Mail-followup-to: Christoph Berg <myon@debian.org>, 517377-done@bugs.debian.org
- In-reply-to: <200903022159.10194.sf@sfritsch.de>
- References: <49A7D1D6.9010504@imis.ch> <200903022159.10194.sf@sfritsch.de>
Re: Stefan Fritsch 2009-03-02 <200903022159.10194.sf@sfritsch.de>
> On Friday 27 February 2009, Tobias Vogel wrote:
> > In case of a normal Firefox access:
> > +0100] "GET /wol/ HTTP/1.1" 304 - "https://proxy.xyz.ch/";
> > "Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.5)
> > Gecko/2008120121 Firefox/3.0.5"
> >
> > In case of the iphone-acess:
> > +0100] "GET /wol HTTP/1.1" 301 269 "-" "Mozilla/5.0 (iPhone; U; CPU
> > iPhone OS 2_2_1 like Mac OS X; en-us) AppleWebKit/525.18.1 (KHTML,
> > like Gecko) Version/3.1.1 Mobile/5H11 Safari/525.20"
>
> You are accessing two different URLs here, /wol and /wol/ . In the
> second case, only the redirect is shown in the log. Maybe your iphone
> browser or some proxy in between has the script source in its cache
> from a time where cgi execution was not yet configured. Or you did
> something wrong when configuring cgis for directory /wol .
Closing the bug.
Christoph
--
cb@df7cb.de | http://www.df7cb.de/
--- End Message ---
Reply to: