[TriLUG] How does this exploit work?

[Ryan Wheaton]

Steve Hoffman wrote:
> 
> If you're that worried about it, awstats can generate the html your
> browser would see and write it to a web directory via cron...in that
> case there's no cgi necessary...although I don't expect you'd have the
> ability to check previous months stats.


this is true, but with a little work, some scripting, cron, and simple 
HTML, you could have awstats generate your pages daily, hourly or 
whatever, and then every month archive that month's pages and generate 
an index file to browse the previous months.  that way, as long as you 
don't need on demand stats, you don't really have to run it as a CGI at 
all.  I've generally banned all CGI activity from my webservers.

rtw