Fw: Bilbao Method Exposed

[FraMe]

----- Original Message -----
From: "FraMe" <frame@hispalab.com>
To: <bugtraq@securityfocus.com>
Sent: Sunday, March 14, 2004 10:04 PM
Subject: [14-M Kernelpanik Release] Bilbao Method Exposed


> Hi!
>
> A brief study about <LIMIT> directive in .htaccess can be downloaded from
> following URL´s:
>
> - English Version: http://www.kernelpanik.org/docs/kernelpanik/bme.eng.pdf
> - Spanish Version: http://www.kernelpanik.org/docs/kernelpanik/bme.esp.pdf
>
> This paper explains a brief form to avoid .htaccess authentification in
> Apache, configured according to criteria of multiple references.
>
> ==============================
> [ FraMe - frame at kernelpanik.org ]
> [ URL - http://frame.lifefromthenet.com ]
> [ Kernelpanik - http://www.kernelpanik.org ]
> [ PGP KeyID - 0x73E1E54B ]
> ==============================

[Mark J Cox]

> - English Version: http://www.kernelpanik.org/docs/kernelpanik/bme.eng.pdf
> - Spanish Version: http://www.kernelpanik.org/docs/kernelpanik/bme.esp.pdf
>
> This paper explains a brief form to avoid .htaccess authentification in
> Apache, configured according to criteria of multiple references.

http://httpd.apache.org/docs-2.0/mod/core.html#limit states "A
<LimitExcept> section should always be used in preference to a <Limit>
section when restricting access, since a <LimitExcept> section provides
protection against arbitrary methods."

See also http://www.apacheweek.com/issues/99-02-12#status

Mark
--
Mark J Cox ........................................... www.awe.com/mark
Apache Software Foundation ..... OpenSSL Group ..... Apache Week editor