The easiest method is in the fine print. If you haven't edited these files, then

• browse to admin/config/media/file-system
• delete sites/default/files/.htaccess
• delete wherever/your/private/files/are/.htaccess as indicated on the page you just browsed to
• click SAVE

This will recreate the two .htaccess files. Then visit the status report and double check things.

Otherwise, edit sites/default/files/.htaccess to be

# Turn off all options we don't need.
Options None
Options +FollowSymLinks

# Set the catch-all handler to prevent scripts from being executed.
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
<Files *>
  # Override the handler again if we're run later in the evaluation list.
  SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003
</Files>

# If we know how to do it safely, disable the PHP engine entirely.
<IfModule mod_php5.c>
  php_flag engine off
</IfModule>

and wherever/your/private/files/are/.htaccess to be

Deny from all

# Turn off all options we don't need.
Options None
Options +FollowSymLinks

# Set the catch-all handler to prevent scripts from being executed.
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
<Files *>
  # Override the handler again if we're run later in the evaluation list.
  SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003
</Files>

# If we know how to do it safely, disable the PHP engine entirely.
<IfModule mod_php5.c>
  php_flag engine off
</IfModule>

Note the difference on line 1 for the private files. This is what prevents files from being browsed to from the outside world. It is also beneficial to place your private file directory outside your DOCROOT if you can, as an added precaution.

The easiest method is in the fine print. If you haven't edited these files, then

• browse to admin/config/media/file-system
• delete sites/default/files/.htaccess
• delete wherever/your/private/files/are/.htaccess as indicated on the page you just browsed to
• delete wherever/your/tmp/files/are/.htaccess as indicated on the page you just browsed to
• click SAVE

This will recreate the two .htaccess files. Then visit the status report and double check things.

Otherwise, edit sites/default/files/.htaccess to be

# Turn off all options we don't need.
Options None
Options +FollowSymLinks

# Set the catch-all handler to prevent scripts from being executed.
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
<Files *>
  # Override the handler again if we're run later in the evaluation list.
  SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003
</Files>

# If we know how to do it safely, disable the PHP engine entirely.
<IfModule mod_php5.c>
  php_flag engine off
</IfModule>

and wherever/your/private/files/are/.htaccess and wherever/your/tmp/files/are/.htaccess to be

Deny from all

# Turn off all options we don't need.
Options None
Options +FollowSymLinks

# Set the catch-all handler to prevent scripts from being executed.
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
<Files *>
  # Override the handler again if we're run later in the evaluation list.
  SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003
</Files>

# If we know how to do it safely, disable the PHP engine entirely.
<IfModule mod_php5.c>
  php_flag engine off
</IfModule>

Note the difference on line 1 for the private files. This is what prevents files from being browsed to from the outside world. It is also beneficial to place your private and tmp file directories outside your DOCROOT if you can, as an added precaution.