Re: CVE-2003-1418 - still affects apache 2 current

2011-09-02 Thread Florian Weimer
* Reindl Harald: mtime - well, is directly in the header - Last-Modified size - well, directly in the header - Content-Length inode - well, where is there any security implication? I guess you could use it to form an NFS handle, and use that to bypass intended access restrictions. But that's

Re: CVE-2003-1418 - still affects apache 2 current

2011-09-02 Thread Reindl Harald
Am 02.09.2011 09:39, schrieb Florian Weimer: * Reindl Harald: mtime - well, is directly in the header - Last-Modified size - well, directly in the header - Content-Length inode - well, where is there any security implication? I guess you could use it to form an NFS handle, and use that

Re: CVE-2003-1418 - still affects apache 2 current

2011-09-02 Thread Nick Kew
On 2 Sep 2011, at 08:49, Reindl Harald wrote: Am 02.09.2011 09:39, schrieb Florian Weimer: * Reindl Harald: mtime - well, is directly in the header - Last-Modified size - well, directly in the header - Content-Length inode - well, where is there any security implication? I guess

Re: svn commit: r1163833 - /httpd/httpd/trunk/modules/http/byterange_filter.c

2011-09-02 Thread Jim Jagielski
On Sep 1, 2011, at 2:44 PM, Roy T. Fielding wrote: On Sep 1, 2011, at 1:11 AM, Tim Bannister wrote: On Wed, Aug 31, 2011 at 6:28 PM, Roy T. Fielding wrote: On Aug 31, 2011, at 6:10 PM, William A. Rowe Jr. wrote: The presumption here is that the client requests bytes=0- to begin the

RE: svn commit: r1163833 - /httpd/httpd/trunk/modules/http/byterange_filter.c

2011-09-02 Thread Plüm, Rüdiger, VF-Group
-Original Message- From: Jim Jagielski [mailto:j...@jagunet.com] Sent: Freitag, 2. September 2011 15:43 To: dev@httpd.apache.org Subject: Re: svn commit: r1163833 - /httpd/httpd/trunk/modules/http/byterange_filter.c On Sep 1, 2011, at 2:44 PM, Roy T. Fielding wrote: On