Drupal security advisory DRUPAL-SA-2006-006: Certain — alas, typical — configurations of Apache allow execution of carefully named arbitrary scripts in the files directory. Drupal now will attempt to automatically create a .htaccess file in your “files” directory to protect you.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/46980/DRUPAL-SA-2006-006.txt
Source: https://packetstormsecurity.com/files/46980/DRUPAL-SA-2006-006.txt.html