Re: [cobalt-users] Cobalt wishlist

[Paul Schreiber <cheesefactory@xxxxxxxxx>]

--- Chris Adams <cmadams@xxxxxxxxxx> wrote:
> > You *are* aware that any site web can turn CGI and SSI back on at will
> > when they are turned off in the GUI by default...? (bu simply adding
> handlers
> > in .htaccess, unless you intentionally make it non readable to the user)
> 
> There is a security hole here too (I reported it over a month ago and
> they said they are working on a fix, but they haven't released one yet).
> 
> Part of the problem is that the wonderful FrontPage extensions require
> "AllowOverride All" in the web config file.

Report it to bugtraq. That'll get it fixed -real- fast. :-)

www.security-focus.com

Paul

__________________________________________________
Do You Yahoo!?
Talk to your friends online with Yahoo! Messenger.
http://im.yahoo.com