Prevent script execution as TimThumb exploit workaround

Question

It's been a long time since I've done any web-development, and I never needed to administer a server myself. However, I can read manuals with the best of them, and when someone needed advice regarding a wordpress installation vulnerable to the TimThumb exploit, I told them to add the follwing to their httpd.conf:

<Directory "/path/to/cache/directory">

    # disallow changing options with a .htaccess file within the cache directory
    AllowOverride None

    # disable all extra features, including CGI scripting
    # prevents malicious code from running
    Options None

    # don't let users browse cached files
    # prevents the attacker from triggering script execution
    Deny from all

    # explicitly disable php - shouldn't be necessary, but just in case ;)
    php_flag engine off

</Directory>

Was that advice sound? In particular, is this the correct choice of directives to prevent any script execution?

Answer 1

Yes, those directives will effectively prevent script execution for any malicious scripts which may be written to that directory, however, you should definitely look at patching or removing any scripts which allow drive-by uploads to your cache directory from unauthenticated or untrusted users.