Subject: Re: Dangers of WWW and FTP on same machine

From: Albert Lunde<[email-masked]>
Date: Wed, 31 Dec 1997 10:03:11 -0600

>Some time ago, I recall reading about some forms of attacks which were made
>vulnerable while running a web server and ftpd on the same machine.  I
>can't find reference to this anymore and wonder if someone can shed some
>light on this issue.

The most obvious risk is if you allow use of a type mapping like .cgi to
designate CGI scripts; if someone can upload a file in a location seen by
the web server, they can then execute arbitrary commands.

There might be other related risks thru server-side includes or other
file-type mappings.

---
    Albert Lunde                      [email-masked]