You are viewing a plain text version of this content. The canonical link for it is here.
Posted to docs@httpd.apache.org by bu...@apache.org on 2010/11/30 22:33:19 UTC
DO NOT REPLY [Bug 50388] New: DNS stealing example might be wrong
https://issues.apache.org/bugzilla/show_bug.cgi?id=50388
Summary: DNS stealing example might be wrong
Product: Apache httpd-2
Version: 2.3-HEAD
Platform: All
OS/Version: All
Status: NEW
Severity: normal
Priority: P2
Component: Documentation
AssignedTo: docs@httpd.apache.org
ReportedBy: calestyo@scientia.net
Hi.
Here http://httpd.apache.org/docs/2.2/dns-caveats.html#denial you describe an
example how traffic to a vhost could be stolen by another one (on the same
server).
In the example it's def.com with control over the domainname, which is the
_second_ vhost definition.
As far as I understood the vhost matching process and as my examples showed,
the first vhost is always used if multiple would match (in both cases IP and
name based).
So that the stealing really works (for def.com) the vhosts woul need to be
swapped:
<VirtualHost www.def.dom>
ServerAdmin webguy@def.dom
DocumentRoot /www/def
</VirtualHost>
<VirtualHost www.abc.dom>
ServerAdmin webgirl@abc.dom
DocumentRoot /www/abc
</VirtualHost>
Or don't I see something?
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: docs-unsubscribe@httpd.apache.org
For additional commands, e-mail: docs-help@httpd.apache.org
DO NOT REPLY [Bug 50388] DNS stealing example might be wrong
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=50388
--- Comment #4 from Rich Bowen <rb...@apache.org> 2010-11-30 17:04:08 EST ---
Darn it. You caught me.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: docs-unsubscribe@httpd.apache.org
For additional commands, e-mail: docs-help@httpd.apache.org
DO NOT REPLY [Bug 50388] DNS stealing example might be wrong
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=50388
--- Comment #2 from Rich Bowen <rb...@apache.org> 2010-11-30 16:54:00 EST ---
I think this must have happened when I changed the examples from a valid domain
(something like mycompany.com) to example.com hostnames, and didn't pay enough
attention to the context. Sorry about that.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: docs-unsubscribe@httpd.apache.org
For additional commands, e-mail: docs-help@httpd.apache.org
DO NOT REPLY [Bug 50388] DNS stealing example might be wrong
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=50388
Eric Covener <co...@gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution| |FIXED
--- Comment #1 from Eric Covener <co...@gmail.com> 2010-11-30 16:49:06 EST ---
flipped examples in 2.2.x and trunk, submitting these as patches would help the
most!
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: docs-unsubscribe@httpd.apache.org
For additional commands, e-mail: docs-help@httpd.apache.org
DO NOT REPLY [Bug 50388] DNS stealing example might be wrong
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=50388
--- Comment #3 from Christoph Anton Mitterer <ca...@scientia.net> 2010-11-30 17:01:24 EST ---
Just claim you did it on purpose in order to check whether the readers really
understand (... and ask) ;)
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: docs-unsubscribe@httpd.apache.org
For additional commands, e-mail: docs-help@httpd.apache.org