[Full-Disclosure] Re: PHP fopen() CRLF Injection

From: Ulf Harnhammar (ulfhat_private)
Date: Thu Sep 12 2002 - 09:32:36 PDT

Next message: Menashe Eliezer: "FW: Bypassing SMTP Content Protection with a Flick of a Button"

Previous message: Ulf Harnhammar: "Re: PHP fopen() CRLF Injection"
In reply to: Ulf Harnhammar: "PHP fopen() CRLF Injection"
Next in thread: Stefan Esser: "Re: PHP fopen() CRLF Injection"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This issue has now been fixed in their CVS repository. This is the
patch that they used:

http://cvs.php.net/diff.php/php4/ext/standard/url.c?r1=1.51&r2=1.52&ty=u&Horde=0

// Ulf Harnhammar
ulfhat_private
http://www.metaur.nu/

On Mon, 9 Sep 2002, Ulf Harnhammar wrote:

> PHP fopen() CRLF Injection
> 
> 
> SUMMARY:
> 
> fopen(), file() and other functions in PHP have a vulnerability
> that makes it possible to add extra HTTP headers to HTTP
> queries. Attackers may use it to escape certain restrictions,
> like what host to access on a web server. In some cases, this
> vulnerability even opens up for arbitrary net connections, turning
> some PHP scripts into proxies and open mail relays.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

Next message: Menashe Eliezer: "FW: Bypassing SMTP Content Protection with a Flick of a Button"
Previous message: Ulf Harnhammar: "Re: PHP fopen() CRLF Injection"
In reply to: Ulf Harnhammar: "PHP fopen() CRLF Injection"
Next in thread: Stefan Esser: "Re: PHP fopen() CRLF Injection"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Thu Sep 12 2002 - 10:06:59 PDT