.htaccess Tutorial

12/01/2011 rahlabs 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhoUzVQuiQnyEvjAegmfFGI4ynoH_7lHJki6aEwr8O4uiWze5AcKjDD-5rI3n7Yv_Vo14c6NMaICeO3LfLgTMIcZwCM5cEdKm_x1SWSjWvtd6w5hjtgszTWGb_Bm3cAMmb4xYzhaLmKzx4t/s1600/htaccess.gif" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhoUzVQuiQnyEvjAegmfFGI4ynoH_7lHJki6aEwr8O4uiWze5AcKjDD-5rI3n7Yv_Vo14c6NMaICeO3LfLgTMIcZwCM5cEdKm_x1SWSjWvtd6w5hjtgszTWGb_Bm3cAMmb4xYzhaLmKzx4t/s1600/htaccess.gif" /></a></div>
<br />
<ul>
<li>Part 1 - Introduction</li>
<li><a href="http://rah-labs.blogspot.com/2011/12/htaccess-tutorial.html#Part2" target="">Part 2 - .htaccess Commands</a></li>
<li><a href="http://rah-labs.blogspot.com/2011/12/htaccess-tutorial.html#Part3" target="">Part 3 - Password Protection</a></li>
</ul>
<br />
<h3>
Introduction</h3>
<br />
In this tutorial you will find out about the .htaccess file and the  power it has to improve your website. Although .htaccess is only a file,  it can change settings on the servers and allow you to do many  different things, the most popular being able to have your own custom  404 error pages. .htaccess isn't difficult to use and is really just  made up of a few simple instructions in a text file.<br />
<br />
<h3 style="color: #000099;">
Will My Host Support It?</h3>
<br />
This is probably the hardest question to give a simple answer to. Many  hosts support .htaccess but don't actually publicise it and many other  hosts have the capability but do not allow their users to have a  .htaccess file. As a general rule, if your server runs Unix or Linux, or  any version of the Apache web server it will support .htaccess,  although your host may not allow you to use it.<br />
<br />
A good sign of whether your host allows .htaccess files is if they  support password protection of folders. To do this they will need to  offer .htaccess (although in a few cases they will offer password  protection but not let you use .htaccess). The best thing to do if you  are unsure is to either upload your own .htaccess file and see if it  works or e-mail your web host and ask them.<br />
<br />
<h3 style="color: #000099;">
What Can I Do?</h3>
<br />
You may be wondering what .htaccess can do, or you may have read about  some of its uses but don't realise how many things you can actually do  with it.<br />
<br />
There is a huge range of things .htaccess can do including: password  protecting folders, redirecting users automatically, custom error pages,  changing your file extensions, banning users with certian IP addresses,  only allowing users with certain IP addresses, stopping directory  listings and using a different file as the index file.<br />
<br />
<h3 style="color: #000099;">
Creating A .htaccess File</h3>
<br />
Creating a .htaccess file may cause you a few problems. Writing the file  is easy, you just need enter the appropriate code into a text editor  (like notepad). You may run into problems with saving the file. Because  .htaccess is a strange file name (the file actually has no name but a 8  letter file extension) it may not be accepted on certain systems (e.g.  Windows 3.1). With most operating systems, though, all you need to do is  to save the file by entering the name as:<br />
<span style="color: blue; font-family: "arial";">".htaccess"</span> (including the quotes). If this doesn't work, you will need to name it  something else (e.g. htaccess.txt) and then upload it to the server.  Once you have uploaded the file you can then rename it using an FTP  program.<br />
<br />
<h3 style="color: #000099;">
Warning</h3>
<br />
Before beginning using .htaccess, I should give you one warning.  Although using .htaccess on your server is extremely unlikely to cause  you any problems (if something is wrong it simply won't work), you  should be wary if you are using the Microsoft FrontPage Extensions. The  FrontPage extensions use the .htaccess file so you should not really  edit it to add your own information. If you do want to (this is not  recommended, but possible) you should download the .htaccess file from  your server first (if it exists) and then add your code to the  beginning.<br />
<br />
<h3 style="color: #000099;">
Custom Error Pages</h3>
<br />
The first use of the .htaccess file which I will cover is custom error  pages. These will allow you to have your own, personal error pages (for  example when a file is not found) instead of using your host's error  pages or having no page. This will make your site seem much more  professional in the unlikely event of an error. It will also allow you  to create scripts to notify you if there is an error (for example I use a  PHP script on Free Webmaster Help to automatically e-mail me when a  page is not found).<br />
<br />
You can use custom error pages for any error as long as you know its  number (like 404 for page not found) by adding the following to your  .htaccess file:<br />
<div class="content shadow-radial">
ErrorDocument errornumber /file.html</div>
<br />
For example if I had the file notfound.html in the root directory of my site and I wanted to use it for a 404 error I would use:<br />
<div class="content shadow-radial">
ErrorDocument 404 /notfound.html</div>
<br />
If the file is not in the root directory of your site, you just need to put the path to it:<br />
<div class="content shadow-radial">
ErrorDocument 500 /errorpages/500.html</div>
<br />
These are some of the most common errors:<br />
<div class="content shadow-radial">
401 - Authorization Required<br />
400 - Bad request<br />
403 - Forbidden<br />
500 - Internal Server Error<br />
404 - Wrong page</div>
<br />
Then, all you need to do is to create a file to display when the error happens and upload it and the .htaccess file.<br />
<br />
<h3 style="border: none;">
<a href="https://www.blogger.com/null" name="Part2"></a>Part 2 - .htaccess Commands</h3>
<br />
<h3 style="color: #000099;">
Introduction</h3>
<br />
In the last part I introduced you to .htaccess and some of its useful  features. In this part I will show you how to use the .htaccess file to  implement some of these.<br />
<br />
<h3 style="color: #000099;">
Stop A Directory Index From Being Shown</h3>
<br />
Sometimes, for one reason or another, you will have no index file in  your directory. This will, of course, mean that if someone types the  directory name into their browser, a full listing of all the files in  that directory will be shown. This could be a security risk for your  site.<br />
<br />
To prevent against this (without creating lots of new 'index' files, you  can enter a command into your .htaccess file to stop the directory list  from being shown:<br />
<div class="system">
Options -Indexes </div>
<br />
<h3 style="color: #000099;">
Deny/Allow Certian IP Addresses</h3>
In some situations, you may want to only allow people with specific IP  addresses to access your site (for example, only allowing people using a  particular ISP to get into a certian directory) or you may want to ban  certian IP addresses (for example, keeping disruptive memembers out of  your message boards). Of course, this will only work if you know the IP  addresses you want to ban and, as most people on the internet now have a  dynamic IP address, so this is not always the best way to limit usage.<br />
<br />
You can block an IP address by using: <br />
<div class="system pop">
deny from 000.000.000.000</div>
  where <br />
<div class="highlight">
000.000.000.000</div>
is the IP address. If you only specify 1 or 2 of the groups of numbers, you will block a whole range.<br />
<br />
You can allow an IP address by using: <br />
<div class="system pop">
allow from 000.000.000.000</div>
  where <br />
<div class="highlight">
000.000.000.000</div>
is the IP address. If you only specify 1 or 2 of the groups of numbers, you will allow a whole range.<br />
<br />
If you want to deny everyone from accessing a directory, you can use:<br />
<div class="system pop">
deny from all</div>
 but this will still allow scripts to use the files in the directory.<br />
<br />
<h3 style="color: #000099;">
Alternative Index Files</h3>
<br />
You may not always want to use index.htm or index.html as your index  file for a directory, for example if you are using PHP files in your  site, you may want index.php to be the index file for a directory. You  are not limited to 'index' files though. Using .htaccess you can set  foofoo.blah to be your index file if you want to!<br />
<br />
Alternate index files are entered in a list. The server will work from  left to right, checking to see if each file exists, if none of them  exisit it will display a directory listing (unless, of course, you have  turned this off).<br />
<br />
<div class="content shadow-radial">
DirectoryIndex index.php index.php3 <a href="http://messagebrd.pl/" target="_blank">messagebrd.pl</a> index.html index.htm</div>
<br />
<br />
<h3 style="color: #000099;">
Redirection</h3>
<br />
One of the most useful functions of the .htaccess file is to redirect  requests to different files, either on the same server, or on a  completely different web site. It can be extremely useful if you change  the name of one of your files but allow users to still find it. Another  use (which I find very useful) is to redirect to a longer URL, for  example in my newsletters I can use a very short URL for my affiliate  links. The following can be done to redirect a specific file:<br />
<div class="content shadow-radial">
Redirect /location/from/root/file.ext <a href="http://www.othersite.com/new/file/location.xyz" target="_blank">http://www.othersite.com/new/file/location.xyz</a></div>
<br />
<br />
In this above example, a file in the root directory called oldfile.html would be entered as:<br />
<div class="content shadow-radial">
/oldfile.html  and a file in the old subdirectory would be entered as:  /old/oldfile.html</div>
<br />
You can also redirect whole directoires of your site using the .htaccess  file, for example if you had a directory called olddirectory on your  site and you had set up the same files on a new site at:  <a href="http://www.newsite.com/newdirectory/" target="_blank">http://www.newsite.com/newdirectory/</a> you could redirect all the files in  that directory without having to specify each one:<br />
<div class="content shadow-radial">
Redirect /olddirectory <a href="http://www.newsite.com/newdirectory" target="_blank">http://www.newsite.com/newdirectory</a></div>
<br />
Then, any request to your site below /olddirectory will bee redirected to the new site, with the extra information in the URL added on, for example if someone typed in:<br />
<br />
<span class="system pop"><a href="http://www.youroldsite.com/olddirecotry/oldfiles/images/image.gif" target="_blank">http://www.youroldsite.com/olddirecotry/oldfiles/images/image.gif</a></span><br />
They would be redirected to:<br />
<span class="system pop"><br />
<a href="http://www.newsite.com/newdirectory/oldfiles/images/image.gif" target="_blank">http://www.newsite.com/newdirectory/oldfiles/images/image.gif</a></span><br />
This can prove to be extremely powerful if used correctly.<br />
<br />
<h3 style="border: none;">
<a href="https://www.blogger.com/blogger.g?blogID=3385998300716176663" name="Part3"></a>Part 3 - Password Protection</h3>
<br />
<h3 style="color: #000099;">
Introduction</h3>
<br />
Although there are many uses of the .htaccess file, by far the most  popular, and probably most useful, is being able to relaibly password  protect directories on websites. Although JavaScript etc. can also be  used to do this, only .htaccess has total security (as someone must know  the password to get into the directory, there are no 'back doors')<br />
<br />
<h3 style="color: #000099;">
The .htaccess File</h3>
<br />
Adding password protection to a directory using .htaccess takes two  stages. The first part is to add the appropriate lines to your .htaccess  file in the directory you would like to protect. Everything below this  directory will be password protected:<br />
<div class="content shadow-radial">
AuthName "Section Name"<br />
AuthType Basic<br />
AuthUserFile /full/path/to/.htpasswd<br />
Require valid-user</div>
<br />
There are a few parts of this which you will need to change for your  site. You should replace "Section Name" with the name of the part of the  site you are protecting e.g. "Members Area".<br />
<br />
The /full/parth/to/.htpasswd should be changed to reflect the full  server path to the .htpasswd file (more on this later). If you do not  know what the full path to your webspace is, contact your system  administrator for details.<br />
<br />
<h3 style="color: #000099;">
The .htpasswd File</h3>
<br />
Password protecting a directory takes a little more work than any of the  other .htaccess functions because you must also create a file to  contain the usernames and passwords which are allowed to access the  site. These should be placed in a file which (by default) should be  called .htpasswd. Like the .htaccess file, this is a file with no name  and an 8 letter extension. This can be placed anywhere within you  website (as the passwords are encrypted) but it is advisable to store it  outside the web root so that it is impossible to access it from the  web.<br />
<br />
<h3 style="color: #000099;">
Entering Usernames And Passwords</h3>
<br />
Once you have created your .htpasswd file (you can do this in a standard  text editor) you must enter the usernames and passwords to access the  site. They should be entered as follows:<br />
<div class="content shadow-radial">
username:password</div>
where the password is the encrypted format of the password. To encrypt  the password you will either need to use one of the premade scripts  available on the web or write your own. There is a good  username/password service at the KxS site which will allow you to enter  the user name and password and will output it in the correct format.<br />
<br />
For multiple users, just add extra lines to your .htpasswd file in the  same format as the first. There are even scripts available for free  which will manage the .htpasswd file and will allow automatic  adding/removing of users etc.<br />
<br />
<h3 style="color: #000099;">
Accessing The Site</h3>
<br />
When you try to access a site which has been protected by .htaccess your  browser will pop up a standard username/password dialog box. If you  don't like this, there are certain scripts available which allow you to  embed a username/password box in a website to do the authentication. You  can also send the username and password (unencrypted) in the URL as  follows:<br />
<span style="color: blue;"><br />
<a href="http://www.website.com/directory/" target="_blank">http://username:password@www.website.com/directory/</a><br />
</span><br />
<h3 style="color: #000099;">
Summary</h3>
<br />
.htaccess is one of the most useful files a webmaster can use. There are  a wide variety of different uses for it which can save time and  increase security on your website.</div>

Part 1 - Introduction Part 2 - .htaccess Commands Part 3 - Password Protection Introduction In this tutorial you will find out ...

Hack Apache based Web Servers

11/30/2011 rahlabs 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div style="text-align: justify;">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"></span><br />
<div class="separator" style="clear: both; text-align: center;">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiBvCx-rmtWhaBWR7HocptgDvTugMFlLWJqKKU-dxLrqom7lEgGqVrEPKLF8rMK7pX8pWGjl-YncFF7zftBqzd8P0_8-k7pOZqtSIxm0nWSoMlBvhpMDjpIdJpW8Utt3aU01_WLiuTPNFAE/s1600/apache_vulnerability_dos.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiBvCx-rmtWhaBWR7HocptgDvTugMFlLWJqKKU-dxLrqom7lEgGqVrEPKLF8rMK7pX8pWGjl-YncFF7zftBqzd8P0_8-k7pOZqtSIxm0nWSoMlBvhpMDjpIdJpW8Utt3aU01_WLiuTPNFAE/s1600/apache_vulnerability_dos.png" /></a></span></div>
<h3 class="post-title entry-title" style="color: #444444; font-family: "Arial", "Tahoma", "Helvetica", "FreeSans", sans-serif; font-size: 22px; font-style: normal; font-variant: normal; font-weight: 700; line-height: normal; margin-bottom: 0px; margin-left: 0px; margin-right: 0px; margin-top: 0px; position: relative;">
</h3>
<h3 class="post-title entry-title" style="color: #444444; font-family: "Arial", "Tahoma", "Helvetica", "FreeSans", sans-serif; font-size: 22px; font-style: normal; font-variant: normal; font-weight: 700; line-height: normal; margin-bottom: 0px; margin-left: 0px; margin-right: 0px; margin-top: 0px; position: relative;">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;">Apache Vulnerability: Hack Apache based Web Servers</span></h3>
<div class="post-header" style="line-height: 1.6; margin-bottom: 1em; margin-left: 0px; margin-right: 0px; margin-top: 0px;">
<div class="post-header-line-1">
</div>
</div>
<div class="post-body entry-content" style="line-height: 1.4; position: relative; width: 506px;">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231"></span></span><br />
<div>
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231"><span class="sidebar-title"><b></b></span></span></span><br />
<center>
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231"><span class="sidebar-title"><b>Apache Vulnerability</b></span></span></span></center>
<br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231"><br /></span></span>
<br />
<ul class="itemizedlist" style="line-height: 1.4; list-style-type: disc; margin-bottom: 0.5em; margin-left: 0px; margin-right: 0px; margin-top: 0.5em; padding-bottom: 0px; padding-left: 2.5em; padding-right: 2.5em; padding-top: 0px;">
<li class="first-listitem" style="border-bottom-color: transparent; border-bottom-style: none; border-bottom-width: 1px; border-left-style: none; border-right-style: none; border-top-style: none; color: #444444; margin-bottom: 0.25em; margin-left: 0px; margin-right: 0px; margin-top: 0px; padding-bottom: 0.25em; padding-left: 0px; padding-right: 0px; padding-top: 0.25em; text-indent: 0px;"><span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231">  <div class="first-para">
The Apache Week tracks the vulnerabilities in Apache Server. Even Apache  has its share of bugs and fixes.</div>
</span></span></li>
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231">
<li class="listitem" style="border-bottom-style: none; border-left-style: none; border-right-style: none; border-top-color: rgb(238, 238, 238); border-top-style: none; border-top-width: 1px; color: #444444; margin-bottom: 0.25em; margin-left: 0px; margin-right: 0px; margin-top: 0px; padding-bottom: 0.25em; padding-left: 0px; padding-right: 0px; padding-top: 0.25em; text-indent: 0px;">  <div class="first-para">
For instance, consider the vulnerability which was found in the Win32 port of Apache 1.3.20.</div>
<ul class="simple-list" style="line-height: 1.4; list-style-type: disc; margin-bottom: 0.5em; margin-left: 0px; margin-right: 0px; margin-top: 0.5em; padding-bottom: 0px; padding-left: 2.5em; padding-right: 2.5em; padding-top: 0px;">
<li class="first-listitem" style="border-bottom-style: none; border-left-style: none; border-right-style: none; border-top-style: none; color: #444444; margin-bottom: 0.25em; margin-left: 0px; margin-right: 0px; margin-top: 0px; padding-bottom: 0.25em; padding-left: 0px; padding-right: 0px; padding-top: 0.25em; text-indent: 0px;">  <div class="first-para">
Long URLs passing through the mod_negative, mod_dir and mode_autoindex modules could cause Apache to list directory contents.</div>
</li>
</ul>
<ul class="itemizedlist" style="line-height: 1.4; list-style-type: disc; margin-bottom: 0.5em; margin-left: 0px; margin-right: 0px; margin-top: 0.5em; padding-bottom: 0px; padding-left: 2.5em; padding-right: 2.5em; padding-top: 0px;">
<li class="first-listitem" style="border-bottom-color: transparent; border-bottom-style: none; border-bottom-width: 1px; border-left-style: none; border-right-style: none; border-top-style: none; color: #444444; margin-bottom: 0.25em; margin-left: 0px; margin-right: 0px; margin-top: 0px; padding-bottom: 0.25em; padding-left: 0px; padding-right: 0px; padding-top: 0.25em; text-indent: 0px;">  <div class="first-para">
The concept is simple but requires a few trial runs.</div>
</li>
<li class="listitem" style="border-bottom-style: none; border-left-style: none; border-right-style: none; border-top-color: rgb(238, 238, 238); border-top-style: none; border-top-width: 1px; color: #444444; margin-bottom: 0.25em; margin-left: 0px; margin-right: 0px; margin-top: 0px; padding-bottom: 0.25em; padding-left: 0px; padding-right: 0px; padding-top: 0.25em; text-indent: 0px;">  <div class="first-para">
A URL with a large number of trailing slashes:</div>
<ul class="simple-list" style="line-height: 1.4; list-style-type: disc; margin-bottom: 0.5em; margin-left: 0px; margin-right: 0px; margin-top: 0.5em; padding-bottom: 0px; padding-left: 2.5em; padding-right: 2.5em; padding-top: 0px;">
<li class="first-listitem" style="border-bottom-style: none; border-left-style: none; border-right-style: none; border-top-style: none; color: #444444; margin-bottom: 0.25em; margin-left: 0px; margin-right: 0px; margin-top: 0px; padding-bottom: 0.25em; padding-left: 0px; padding-right: 0px; padding-top: 0.25em; text-indent: 0px;">  <div class="first-para">
/cgi-bin /////////////////////////// / could produce directory listing of the original directory.</div>
</li>
</ul>
</li>
</ul>
</li>
</span></span></ul>
</div>
<table border="0" cellpadding="0" cellspacing="0" class="BlankSpace"><tbody>
<tr><td height="16"></td></tr>
</tbody></table>
<div class="para">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231">The purpose of discussing the various vulnerabilities of the web server here is to highlight how ingenious attackers can be in exploring the functionality of the various components that they are able to elicit an unexpected and previously unknown behavior of a piece of code. No matter how insignificant it is, a security breach can have far reaching implications if left unattended.</span></span></div>
<div class="para">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231">This is not the only issue in focus. The possibility of eliminating flawed coding practices and incorporating proper testing must not be ignored as security measures.</span></span></div>
<div class="para">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231">The Apache Week tracks the vulnerabilities in Apache Server. For instance, consider the vulnerability which was found in the Win32 port of Apache 1.3.20. Because of this, a client submitting a very long URI could cause a directory listing to be returned rather than the default index page. This was subsequently fixed in Apache httpd 1.3.22</span></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231"><br /></span></span></div>
<table border="0" cellpadding="0" cellspacing="0" class="note"><tbody>
<tr><td class="admon-check" valign="top"></td><td class="admon-title" valign="top" width="56"><b>Threat</b></td><td class="admon-body" valign="top"><div class="first-para">
<b>Some of the other vulnerabilities have been:</b></div>
</td></tr>
</tbody></table>
<div class="para">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231"><i class="emphasis">Remote DoS via IPv6</i>: When a client requests that proxy ftp connect to an ftp server with IPv6 address, and the proxy is unable to create an IPv6 socket, an infinite loop occurs causing a remote Denial of Service. This has been fixed in Apache httpd 2.0.47</span></span></div>
<div class="para">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231"><i class="emphasis">Remote DoS with multiple Listen directives</i>: In a server with multiple listening sockets a certain error returned by accept () on a rarely access port can cause a temporary denial of service, due to a bug in the prefork MPM. This has been fixed in Apache httpd 2.0.47</span></span></div>
<div class="para">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231"><i class="emphasis">APR remote crash</i>: A vulnerability in the apr_psprintf function in the Apache Portable Runtime (APR) library allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via long strings, as demonstrated using XML objects to mod_dav, and possibly other vectors. This has been fixed in Apache httpd 2.0.46</span></span></div>
<div class="para">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231"><i class="emphasis">Basic Authentication DoS</i>: A build system problem in Apache 2.0.40 through 2.0.45 allows remote attackers to cause a denial of access to authenticated content when a threaded server is used. This has been fixed in Apache httpd 2.0.46</span></span></div>
<div class="para">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231"><i class="emphasis">Line feed memory leak DoS</i>: Apache 2.0 versions before Apache 2.0.45 have a significant Denial of Service vulnerability. Remote attackers can cause a denial of service (memory consumption) via large chunks of linefeed characters, which causes Apache to allocate 80 bytes for each linefeed. This has been fixed in Apache httpd 2.0.45</span></span></div>
<div class="para">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231"><i class="emphasis">MSDOS device names cause DoS</i>: Apache versions before 2.0.44 on Windows do not correctly filter MS-DOS device names which can lead to denial of service attacks and remote code execution. This has been fixed in Apache httpd 2.0.44</span></span></div>
<div class="para">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231"><i class="emphasis">Apache can serve unexpected files</i>: On Windows platforms Apache could be forced to serve unexpected files by appending illegal characters such as '<' to the request URL. This has been fixed in Apache httpd 2.0.44</span></span></div>
<div class="para">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231"><i class="emphasis">Rewrite rules that include references allow access to any file</i>: The Rewrite module, mod_rewrite, can allow access to any file on the web server. The vulnerability occurs only with certain specific cases of using regular expression references in Rewrite Rule directives: If the destination of a Rewrite Rule contains regular expression references then an attacker will be able to access any file on the server. This has been fixed in Apache httpd 1.3.14</span></span></div>
</div>
</div>
<div style="text-align: justify;">
<br /></div>
<br /></div>

Apache DOS Hacking Hacking Tutorials Linux Tutorials Server Tutorials Vulnerability Hack Apache based Web Servers

Apache Vulnerability: Hack Apache based Web Servers Apache Vulnerability The Apache Week tracks the vulnerabilitie...

.htaccess Tutorial

Hack Apache based Web Servers

Popular

Comments

Archive