From owner-freebsd-security  Fri Jun 15 10:51:12 2001
Delivered-To: freebsd-security@freebsd.org
Received: from gaia.nimnet.asn.au (nimbin.lnk.telstra.net [139.130.45.143])
	by hub.freebsd.org (Postfix) with ESMTP id E3E0E37B403
	for <freebsd-security@FreeBSD.ORG>; Fri, 15 Jun 2001 10:51:07 -0700 (PDT)
	(envelope-from smithi@nimnet.asn.au)
Received: from localhost (smithi@localhost)
	by gaia.nimnet.asn.au (8.8.8/8.8.8R1.2) with SMTP id DAA09548;
	Sat, 16 Jun 2001 03:50:43 +1000 (EST)
	(envelope-from smithi@nimnet.asn.au)
Date: Sat, 16 Jun 2001 03:50:43 +1000 (EST)
From: Ian Smith <smithi@nimnet.asn.au>
To: "Karsten W. Rohrbach" <karsten@rohrbach.de>
Cc: Yonatan Bokovza <Yonatan@xpert.com>, freebsd-security@FreeBSD.ORG
Subject: Re: apache security question
In-Reply-To: <20010614212241.G49807@mail.webmonster.de>
Message-ID: <Pine.BSF.3.96.1010616034350.5465F-100000@gaia.nimnet.asn.au>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

On Thu, 14 Jun 2001, Karsten W. Rohrbach wrote:

 > > > > > It appears to me like they somehow executed the 'head' 
 > > > command... how
 > > > would
 > > > > > one do this, and how could you stop it?
 > 
 > HTTP HEAD gives you the headers of the corresponding GET operation.
 > different from GET, where you will also get the object data, HEAD
 > transmits only the headers like with GET but no (file) object data.

And so, HEAD requests are not any more harmful nor dangerous than GET
requests, which one is presumably happy to permit to a web server :-) 

Cheers, Ian


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message