As far as https://drupal.org/SA-CORE-2013-003; It suggests,
To fix the code execution prevention vulnerability on existing Apache
installations also requires changes to your site's .htaccess files in
the files directories. Until you do this, your site's status report
page at admin/reports/status will display error messages about the
problem. Please note that if you are using a different web server such
as Nginx the .htaccess files have no effect and you need to configure
PHP execution protection yourself in the respective server
configuration files.
To fix this issue, you must edit or replace the old .htaccess files
manually. Copies of the .htaccess files are found in the site's files
directory and temporary files directory, and (for Drupal 7 only) the
separate private files directory if your site is configured to use
one. To find the location of these directories, consult the error
messages at admin/reports/status, or visit the file system
configuration page at admin/settings/file-system (Drupal 6) or
admin/config/media/file-system (Drupal 7). Note that you should only
make changes to the .htaccess files that are found in the directories
specified on that page. Do not change the top-level .htaccess file (at
the root of your Drupal installation).
Go onto your server, navigate to each directory, and replace or create
the .htaccess file in this directory with the contents described
below. Alternatively, you can remove the .htaccess file from each
directory using SFTP or SSH and then visit the file system
configuration page (admin/settings/file-system in Drupal 6 or
admin/config/media/file-system in Drupal 7) and click the save button
to have Drupal create the file automatically.
The recommended .htaccess file contents are as follows.
For Drupal 6:
Turn off all options we don't need. Options None Options +FollowSymLinks
Set the catch-all handler to prevent scripts from being executed. SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
Override the handler again if we're run later in the evaluation list.
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003
If we know how to do it safely, disable the PHP engine entirely. php_flag engine off
PHP 4, Apache 1. php_flag engine off
PHP 4, Apache 2. php_flag engine off For Drupal 7:
Turn off all options we don't need. Options None Options +FollowSymLinks
Set the catch-all handler to prevent scripts from being executed. SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
Override the handler again if we're run later in the evaluation list.
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003
If we know how to do it safely, disable the PHP engine entirely. php_flag engine off Additionally,
the .htaccess of the temporary files directory and private files
directory (if used) should include this command:
Deny from all