A vulnerability has been identified in Apache, which could be exploited by local attackers to bypass security restrictions. This issue is caused by an error within the handling of the "Options" and "AllowOverride" directives, which could allow malicious users to bypass restrictios and execute commands from a Server-Side-Include script.

Affected Products

Apache versions 2.2.x

Solution

A fix is available via SVN :
http://svn.apache.org/viewvc?view=rev&revision=772997

References

http://www.vupen.com/english/advisories/2009/1444
https://bugzilla.redhat.com/show_bug.cgi?id=489436

Credits

Vulnerability reported by Jonathan Peatfield.

Changelog

2009-05-28 : Initial release

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.