Apache CGI Source Code Viewing Vulnerability

If the Apache configuration file (/etc/httpd/httpd.conf) contains the following Alias entry, then all files in /cgi-bin/ can be accessed via URLs of the format http://target/cgi-bin-sdb:

Alias /cgi-bin-sdb/ /usr/local/httpd/cgi-bin/

Because the path does not contain the string /cgi-bin/, improper permissions are assigned, and the file is sent to the client instead of being executed on the server. Basically, the existence of the cgi-bin-sdb alias makes it possible for malicious users to view the source code of CGI scripts stored in /cgi-bin/.

SuSE Linux Versions 6.3 and 6.4 (prior versions may also be vulnerable) install Apache Web server (Version 1.3.12 in Version 6.4 of SuSE) with this kind of configuration file.

If successfully exploited, malicious users can view the source code of CGI scripts stored in /cgi-bin/.

You can comment out the offending entry in the Apache configuration file (/etc/httpd/httpd.conf) with a pound sign (#). See below:

#Alias /cgi-bin-sdb/ /usr/local/httpd/cgi-bin/

Alternatively, you can change this line so that CGI scripts can be executed, but not read. To do so, change the line to the following, and then stop and restart the server.

ScriptAlias /cgi-bin-sdb/ /usr/local/httpd/cgi-bin/

Updates are available for SuSE Linux. Contact your vendor for upgrade or patch information.