COMMAND

	Apache directory traversal via redirect ?

SYSTEMS AFFECTED

	Apache HTTP server 2.0, non-Unix platforms

PROBLEM

	Mark    J    Cox    In     Apache     software     foundation     alert,
	[http://httpd.apache.org/info/security_bulletin_20020809a.txt] :
	

	--snipp--
	

	This vulnerability has the potential to allow  an  attacker  to  inflict
	serious  damage  to  a  server,  and   reveal   sensitive   data.   This
	vulnerability affects default installations of the Apache web server.
	

	--snipp--
	

	Credit   for   this    bug    finding    goes    to    Auriemma    Luigi
	[bugtest@sitoverde.com]

SOLUTION

	A simple one line workaround in  the  httpd.conf  file  will  close  the
	vulnerability. Prior to the first 'Alias' or 'Redirect'  directive,  add
	the following directive to the global server configuration:
	

	   RedirectMatch 400 "\\\.\."

	

	Fixes for this vulnerability are also included  in  Apache  HTTP  server
	version 2.0.40. The 2.0.40 release also contains  fixes  for  two  minor
	path-revealing  exposures.  This  release  of  Apache  is  available  at
	http://www.apache.org/dist/httpd/