New answers tagged

1

The same "vulnerability" is in C, Java, Perl, Ruby, Lisp, Fortran, BASIC, PASCAL, ALGOL....programming languages almost universally provide a construct for reading files. Some files on a Unix system are world readable. I do not have control on developers about what code they are uploading... Then by all means try to mitigate silly mistakes, but don't ...


0

You can restrict which directories PHP scripts may access using the open_basedir configuration. e.g. putting open_basedir = /var/www/ in your php.ini file should restrict PHP to /var/www/


0

One way to stop Apache from reading system files (and, in general, any file outside the web root directory) is with SELinux. Its whole purpose is to prevent inappropriate access to system resources (not restricted to constraining Apache, but that sort of protection is one of its great benefits). You would need to use an operating system that supported it, ...


3

This is not a vulnerability in Apache. It is a vulnerability in your PHP code. The function include(x) includes the file x. If you let the user pick any x, they will be able to include any file. If you don't want them to be able to do that, then don't write PHP code that lets them. I suggest you only pass constants or values from a whitelist as parameters ...


1

In addition to cloud services, some programs like Adobe Lightroom will attempt to download pictures from literally any device you plug into the computer (USB drive, SD card, Android phones, possibly iPod?). It's quite annoying, and someone not paying attention could blindly click "yes" to the prompts. You don't mention the nature of the pictures but I'm ...


2

A simple explanation is that a cloud backup app is set up on the PC and will sync files which are loaded to the cloud (such as dropbox, box, onedrive, google drive, etcetc) by also copying files down to the PC. If you want a more detailed answer you are going to have to provide more info, though. Was the PC turned on or off? Why do you suspect it wasn't ...


2

Copying is just reading a file's contents and writing them somewhere else. If a user can read a file, they can copy its contents to somewhere where they have write access. On Windows, there are copy hooks that you could use to log or block the operation, but those only apply to the shell (i.e. Explorer). Using the command prompt would bypass such hooks. If ...


3

I recommend OSSEC, and or (mentioned by Schroeder) Tripwire. However, I also recommend principle of least privileges. If you have your developers all using escalated privileges to do their work, I emphasize placing them in groups, and using sudo. For added measures, I'd add timestamps to bash history files where applicable. This will enable you to track what ...



Top 50 recent answers are included