Re: .htaccess, CVE-2000-0234 and Zend

[Pete Helgren <pete@xxxxxxxxxx>]

I haven't seen this on my own servers.   Maybe this could help: 
https://htaccessbook.com/protect-htaccess-files/

Not sure why your .htaccess files would be "readable"...seems unusual to me

Pete Helgren
www.petesworkshop.com
GIAC Secure Software Programmer-Java
Twitter - Sys_i_Geek  IBM_i_Geek

On 8/22/2018 7:46 AM, Rob Berendt wrote:
> We recently installed Zend on a system.  Since then we are getting dinged
> on a Qualys security scan.
> THREAT:
> .htaccess contains authentication information.
> IMPACT:
> Unauthorized users can gather authentication information from this file.
> SOLUTION:
> Change the Apache configuration so the .htaccess file cannot be accessed
> via the Internet.
> EXPLOITABILITY:
> The Exploit-DB
> Reference: CVE-2000-0234
> Description: Cobalt RaQ 2.0/3.0 - Apache .htaccess Disclosure - The
> Exploit-DB Ref : 19828
> Link: http://www.exploit-db.com/exploits/19828
> RESULTS:
> GET /.htaccess HTTP/1.1
> Host: 10.10.6.129:10081
> Connection: Keep-Alive
>
> I see .htaccess in two directories:
> /usr/local/zendphp7/5250/Emulator/html
> usr/local/zendphp7/gui/public
>
> How does one: "Change the Apache configuration so the .htaccess file
> cannot be accessed via the Internet."?
>
> I tried googling that but all I found were descriptions of the benefits
> and risks of using .htaccess file.
> The first google hit should have been the "end all, be all" as it was a
> qualys hit:
> https://community.qualys.com/thread/17767-how-to-configure-apache-so-that-the-htaccess-file-cannot-be-accessed-via-the-internet#comment-38864
> However I could not find the answer in the link offered.  Then again, it
> may have shot right over my head since I'm not even up to the beginner
> level in apache configuration.
>
> Rob Berendt