I ran into an example of a web application vulnerable to Apache AddHandler/AddType misconfiguration by chance today. The releases notes of Magento Community Edition 1.9.1 point to a remote code execution vulnerability.
Interestingly, the section
Determining Your Vulnerability to the File System Attack
is precisely a switch from
SetHandler. Fantastic! Let's see
if I can use that to convince web hoster X that is still arguing that use of
AddHandler would be good enough.
PS: Before anyone takes this for advice to switch to vanilla 18.104.22.168, be sure to apply post-release easy-to-overlook patch "SUPEE-5344", too. Details are up at (German) Magento-Shops stehen Angreifern offen or (English) Analyzing the Magento Vulnerability.