: Prevent script execution as TimThumb exploit workaround It's been a long time since I've done any web-development, and I never needed to administer a server myself. However, I can read manuals

@Si4351233

Posted in: #Apache #Php

It's been a long time since I've done any web-development, and I never needed to administer a server myself. However, I can read manuals with the best of them, and when someone needed advice regarding a wordpress installation vulnerable to the TimThumb exploit, I told them to add the follwing to their httpd.conf:

<Directory "/path/to/cache/directory">

# disallow changing options with a .htaccess file within the cache directory
AllowOverride None

# disable all extra features, including CGI scripting
# prevents malicious code from running
Options None

# don't let users browse cached files
# prevents the attacker from triggering script execution
Deny from all

# explicitly disable php - shouldn't be necessary, but just in case ;)
php_flag engine off

</Directory>


Was that advice sound? In particular, is this the correct choice of directives to prevent any script execution?

Vote Up Vote Down

Login to post a comment!