You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@httpd.apache.org by "Robert S. Thau" <rs...@ai.mit.edu> on 1995/04/12 15:17:20 UTC

Re: ANOTHER hole in NCSA httpd1.3R

The only comprehensive anser is the CERT patch.  We've got it.

rst

Re: ANOTHER hole in NCSA httpd1.3R

Posted by Rob McCool <ro...@netscape.com>.

/*
 * "Re: ANOTHER hole in NCSA httpd1.3R" by rst@ai.mit.edu (Robert S. Thau)
 *    written Wed, 12 Apr 95 09:17:20 EDT
 * 
 * The only comprehensive anser is the CERT patch.  We've got it.  rst
 *
 */

Have you modified the URL reading routine so that it will only read
HUGE_STRING_LEN/2 characters from the client? I don't remember that
being in the CERT patch, and it's a Good Idea.

--Rob