Re: [cobalt-users] [Raq4] Directory Listing Exploit found.

[Nico Meijer <nico.meijer@xxxxxxxxx>]

Hi Kai,

> Simple as that.

I hope for you it is.

> I'm in the process of developing my AUP and
> hosting contract etc.

Good call.

> The php info thing is fine. I mean, that simply displays what they can and
> can't do... but they can still do it.

I have phpinfo() disabled. I do not allow my clients or any other person to know what version of apache I'm running, whether I'm running *nix, or whatever. If clients need to know, I tell 'em. They're on a "need to know basis" only. Geez, I sound like the military. ;-P

> I really need PHP to follow the
> "Options -Indexes" expression. Otherwise my customers data publicly
> available.

Sorry, dunno of this can be done.

> Try it.

No thank you. ;-)

Seriously, I'll try it on a testbox.

> Hopefully now that i've posted it someone will come up with a way of
> protecting us.

For the time, you could disable readdir, opendir and closedir (or either one of those) if none of your clients use it legitimately. Then test it again. Your connection should hang.

Good luck... Nico