Hello NDR113, If you have PHP pages handled by ISAPI filter it may be a problem oh ISAPI filter which comes with PHP 4. Check php logs - if PHP is called on request to http://www.server.com/file.php::$DATA - it's PHP specific problem. --Saturday, October 27, 2001, 2:00:52 AM, you wrote to vuln-devat_private: N> Data Stream Bug may still work (on a unsual configuration) N> [===================================] N> + Past Problem N> The Windows NT file system, NTFS, support multiple data streams within a N> file, been DATA the main content stream. N> Was reported on July 8, 1998 by Paul Ashton on this mailing list the N> posibility of get remotely by IIS the source code of files like an ASP N> script. This was done by requesting the file and ::$DATA. Microsoft relase a N> fix, and the problem was solve on the subsequent Service Packs for Windows N> NT. N> + Present Problem N> Yet, this problem -it seems to us- that on some unusual configuration as a N> Windows NT box, with IIS and PHP scripting, persist. In our tests on two N> separete Windows NT boxes, with IIS 4, PHP4, the fix available for the bug N> and the latest SP6a, is still possible to obtain the source of PHP files. N> eg. http://www.server.com/file.php::$DATA N> + Implications N> Besides the obvious vulnerability, this show that the fix given by Microsoft N> far from solving the real problem, it just did the the "workarounds" on the N> registry on how to manage specific extensions (.asp, .pl, and so on) N> excluding .php. N> + Final N> Anyone how can confirm or refute this please post it. N> + More Informtion N> ":$DATA Stream Name of a File May Return Source" N> http://support.microsoft.com/support/kb/articles/Q188/8/06.ASP N> "HOW TO: Use NTFS Alternate Data Streams" N> http://support.microsoft.com/support/kb/articles/Q105/7/63.ASP N> Roberto Alamos M. (theyeat_private) N> Carlos Gaona U. (ndr113at_private) N> www.350cc.com -- ~/ZARAZA Êîãäà ïòè÷êà ïîãèáàåò îò îáæîðñòâà, åå íàíèçûâàþò íà âåðòåë. (Ëåì)
This archive was generated by hypermail 2b30 : Sat Oct 27 2001 - 09:52:19 PDT