Re: Apache 2.x leaked descriptors

Steve Grubb wrote:
> It is normal practice for webhosting companies to put multiple clients on

you can do more than that. unless the web server uses suexec, all the cgi's run as the webserver user, who most likely has:

at least w to all log files for all vhosts (probably r+w) at least r on all webhosting directories at least r+x on all cgi-bin directories

this is (and has been) a known issue for a while. it has periodically been discussed on the apache mailing lists, and i think it came up on bugtraq recently as well.

-jon

-- 
jon@divisionbyzero.com || www.divisionbyzero.com
gpg key: www.divisionbyzero.com/pubkey.asc
think i have a virus? www.divisionbyzero.com/pgp.html
"You are in a twisty little maze of Sendmail rules, all confusing."