It's been a long time since I've done any web-development, and I never needed to administer a server myself. However, I can read manuals with the best of them, and when someone needed advice regarding a wordpress installation vulnerable to the TimThumb exploit, I told them to add the follwing to their
<Directory "/path/to/cache/directory"> # disallow changing options with a .htaccess file within the cache directory AllowOverride None # disable all extra features, including CGI scripting # prevents malicious code from running Options None # don't let users browse cached files # prevents the attacker from triggering script execution Deny from all # explicitly disable php - shouldn't be necessary, but just in case ;) php_flag engine off </Directory>
Was that advice sound? In particular, is this the correct choice of directives to prevent any script execution?