Re: Rumours about Apache 1.3.22 exploits

From: Mike Tone (simpletoneat_private)
Date: Mon Feb 25 2002 - 18:15:44 PST

  • Next message: Matt Conover: "w00bind claims false"

    One quick thing we should get straight... 
    
    PHP has problems, on the win32 platform (apache 1.3.x)...
    
    but on *nix as well??  
    
    --snip-from-bugware
    PHP for windows arbitrary files execution (feb2002)
    
    SYSTEMS AFFECTED
    PHP version 4.1.1 under Windows
    PHP version 4.0.4 under Windows
    	
    PROBLEM
    CompuMe and RootExtractor posted :
    
    An attacker can upload innocent looking files  (with  mp3,  txt  or  gif
    extensions) through any uploading systems such as  WebExplorer  (or  any
    other PHP program that has uploading  capabilities),  and  then  request
    PHP to execute it.
    --snap
    
    
    as for bind issues (i have nfi), blame non-disclosure.
    
    
    ---------------------------------------------------------------------
    Never lose a fax again, receive faxes to your personal email account!
    Visit http://www.mbox.com.au/fax
    



    This archive was generated by hypermail 2b30 : Tue Feb 26 2002 - 02:16:01 PST