Re: [gentoo-user] apache2 AddHandler/SetHandler vulnerability

[Mick]

On Sunday 26 Apr 2015 01:51:37 Michael Orlitzky wrote:
> On 04/25/2015 05:23 PM, Grant wrote:
> > I read about this vulnerability in the
> > 2015-04-06-apache-addhandler-addtype Gentoo news item.  I don't think
> > I'm using any functionality that could expose me to the problem but
> > I'd like to be able to say so for sure.  Does the fact that I'm
> > up-to-date with GLSAs, I don't have PHP5 in APACHE2_OPTS (I use
> > php-fpm), along with the following (which I think is default) indicate
> > that I'm not vulnerable?
>
> (1) Do you allow untrusted people to upload files to your server?
>
> (2) If so, do you try to prevent them from uploading PHP files
>     based on a regular expression or shell glob?
>
> Unless you answer "yes" to both of those questions, you don't need to
> check anything.
>
> The vulnerability is that with,
>
>   AddHandler application/x-httpd-php .php
>
> Apache will go ahead and try to execute (for example) foo.php.html. If
> you're blocking uploads of *.php to prevent people from uploading PHP
> scripts, then I could name my file foo.php.html and bypass your
> restriction.
>
> The AddHandler behavior was documented, but incredibly unexpected -- and
> we had it in the default configuration. The new config we ship uses,
>
>   <FilesMatch "\.php$">
>     SetHandler application/x-httpd-php
>   </FilesMatch>
>
> instead so only *.php files get executed.

Hmm ... I am probably affected by this change too.  Running find for '*.php.*' 
et al, comes up with a tonne of files like this:

/var/www/My_Website_Name/htdocs/modules/simpletest/tests/upgrade/drupal-7.filled.minimal.database.php.gz

If I were to manually install protection, as suggested in the news item, where 
should I be doing this?  In (umpteen) .htaccess files for each vhost, or 
somewhere in /etc/apache2/*

-- 
Regards,
Mick