Re: A patch to keep cache directory out of webroot

Alla Bezroutchko wrote:
> [...lots of good info...]
> 
> On IIS WebDAV is enabled by default, out of the box. Even worse, 
> depending on the version of IIS the uploaded file might be executed as 
> SYSTEM (root analog on Windows). So on IIS a writable directory in 
> webroot might mean an direct way to compromise the system completely.
> 
> It is possible to avoid this problem on Apache by either disabling 
> WebDAV, configuring access control lists or denying access to the 
> directory through Apache config. On IIS it might be possible to work 
> around it using something like urlscan tool from Microsoft. In any case, 
> I suppose, this should be documented, so at least you can say "we told 
> you".
> 
> Alla.
> 

Thanks again for raising this Alla,

And thank you very much for the detailed description of the vulnerabilities.

I hope to have a scenario in place next week to work out a long term 
solution.  I'll post the info here when it is available so others can 
participate, should anyone so choose.

  - Jonn