funny how you run into bad stuff when you're already doing three things at once

[rone]

[2006/10/21 17:09:11] {co-worker} says: http://www.visiblepath.com/cgi-bin/env.pl

[2006/10/21 17:09:16] ronebofh says: ... wtf
[2006/10/21 17:09:35] ronebofh says: abort! abort!

Comments

[marknau.livejournal.com]

Why were you sorting your music by time?

Freak.

[ronebofh.livejournal.com]

Hahaha, i was waiting to see who'd mention that first.

As to why, it adds an element of randomness to my already shuffled playlist.

[paracelsvs.livejournal.com]

I DONUT GEDDIT

[thedarkages]

As far as I remember it, env.pl is a standard sample script dating back to the old httpd server that could be placed in the cgi-bin directory for testing purposes. By calling it, someone can find out many interesting things about the way your server is set up, things about which you would prefer to leave the public in ignorance. That it's still there in a public site's cgi-bin directory is a big mistake.

[paracelsvs.livejournal.com]

I dunno, on the scale of security concerns, that seems to rank somewhere between "obsessive-compulsive" and "pointless paranoia". So I still DONUT GEDDIT.

[ronebofh.livejournal.com]

It's information that has no business being public. And network security should definitely have a fair amount of obsessive-compulsiveness and paranoia.

[paracelsvs.livejournal.com]

Maybe, but the only information I see in there that isn't already publically available are a couple of internal paths, and maybe the server IP, depending on whether that is publically visible already or not. If an attacker gets to the point where he has any use for knowing the internal paths, you're most likely screwed either way. I really don't see the big deal. I mean, the server is already running PHP. It's not exactly a tight ship.

[paracelsvs.livejournal.com]

Oh, that was actually on another server. But still.

[ronebofh.livejournal.com]

Sure, but it's still information that has no business being public.

[paracelsvs.livejournal.com]

I guess I was just expecting more of a punch-line.

[ronebofh.livejournal.com]

"I guess you had to be there." OH ZING!