BugTraq
Re: [Full-disclosure] Apache suEXEC privilege elevation / information disclosure Aug 10 2013 10:10AM
Gichuki John Chuksjonia (chuksjonia gmail com) (3 replies)
Re: [Full-disclosure] Apache suEXEC privilege elevation / information disclosure Aug 10 2013 02:25PM
Reindl Harald (h reindl thelounge net)


Am 10.08.2013 12:10, schrieb Gichuki John Chuksjonia:
> One thing u gotta remember most of the Admins who handle webservers in
> a network are also developers since most of the organizations will
> always need to cut on expenses, and as we know, most of the developers
> will just look into finishing work and making it work. So if something
> doesn't run due to httpd.conf, you will find these guys loosening
> server security, therefore opening holes to the infrastructure.

i am one of the developers who are admin

why?

because maintaining servers where only internal developed
software gives you the power to make security as tighten
as possible - and yes security is *always* first

not the admins which are developers are the problem

crap like wordpress, joomla, phpBB is the problem because
these developers have no idea how to secure maintain a
server and try to develop software which can be installed
by any random fool on whatever webserver without understand
the implications

thats's why these applications are *strictly* forbidden
on any machine i am responsible for, it's enough to write
abuse mails each time one of these installations outside
got hacked and is starting attacks on 3rd parties

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iEYEARECAAYFAlIGTXMACgkQhmBjz394AnnXagCfbwWx8lhcpGCZicxcmW4neZtL
IAcAoJgYrZpKHIivn4H/+7WjcFAIMYuX
=6jTx
-----END PGP SIGNATURE-----

[ reply ]
Re: [Full-disclosure] Apache suEXEC privilege elevation / information disclosure Aug 10 2013 10:49AM
Jeffrey Walton (noloader gmail com)


 

Privacy Statement
Copyright 2010, SecurityFocus