Apache Web Server默认脚本映射可绕过漏洞发布时间：2003-01-22 更新时间：2003-01-22 严重程度：中 威胁程度：其它 错误类型：设计错误 利用方式：服务器模式 BUGTRAQ ID：6661 受影响系统 Apache Software Foundation Apache 2.0.36详细描述 Apache WEB服务程序是流行的HTTP程序，可使用在UNIX和WINDOWS操作系统上。 APACHE WEB服务程序存在缺陷可导致绕过默认脚本映射。如下面的URL： http://localhost/folder.php/file Apache会以明文方式解析'file'，并简单的返回给浏览器，但是APACHE映射算法不正确，导致‘php'扩展与此请求关联。就是说把'file'以PHP脚本来进行解析。 测试代码 尚无 解决方案 升级程序： Apache Software Foundation Apache 2.0.36: Apache Software Foundation Upgrade Apache httpd 2.0.44 http://www.apache.org/dist/httpd/ Apache Software Foundation Apache 2.0.37: Apache Software Foundation Upgrade Apache httpd 2.0.44 http://www.apache.org/dist/httpd/ Apache Software Foundation Apache 2.0.38: Apache Software Foundation Upgrade Apache httpd 2.0.44 http://www.apache.org/dist/httpd/ Apache Software Foundation Apache 2.0.39: Apache Software Foundation Upgrade Apache httpd 2.0.44 http://www.apache.org/dist/httpd/ Apache Software Foundation Apache 2.0.40: Apache Software Foundation Upgrade Apache httpd 2.0.44 http://www.apache.org/dist/httpd/ Apache Software Foundation Apache 2.0.41: Apache Software Foundation Upgrade Apache httpd 2.0.44 http://www.apache.org/dist/httpd/ Apache Software Foundation Apache 2.0.42: Apache Software Foundation Upgrade Apache httpd 2.0.44 http://www.apache.org/dist/httpd/ Apache Software Foundation Apache 2.0.43: Apache Software Foundation Upgrade Apache httpd 2.0.44 http://www.apache.org/dist/httpd/ 相关信息 参考：http://www.apache.org/dist/httpd/Announcement2.html http://www.apache.org/dist/httpd/CHANGES_2.0 http://lists.netsys.com/pipermail/full-disclosure/2003-January/003653.html |
