<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">I've patched the DYFI form to close this loophole.<div><br></div><div>Thanks,</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>~Eric.</div><div><br><div><div>On Aug 11, 2011, at 3:07 PM, Christopher J Bidwell wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><font size="2" face="sans-serif">I need to shut down apache on ehp2 for
a bit. </font>
<br>
<br><font size="2" face="sans-serif">Looks like someone was able to get into
/etc/ via a webform on DYFI.</font>
<br>
<br><font size="2" face="sans-serif">I will be checking ehp1,3, and 4 as
well.</font>
<br><font size="2" face="sans-serif">----------------<br>
Thank you,<br>
<br>
Chris Bidwell, RHCSA<br>
Red Hat Linux Administrator<br>
National Earthquake Information Center<br>
US Geological Survey<br>
email: <a href="mailto:cbidwell@usgs.gov">cbidwell@usgs.gov</a><br>
work: 303-273-8642<br>
mobile: 303-435-6362<br>
</font>_______________________________________________<br>EHPweb mailing list<br><a href="mailto:EHPweb@geohazards.usgs.gov">EHPweb@geohazards.usgs.gov</a><br>https://geohazards.usgs.gov/mailman/listinfo/ehpweb<br></blockquote></div><br></div></body></html>