[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <200810281050.17900.hanno@hboeck.de>
Date: Tue, 28 Oct 2008 10:50:17 +0200
From: Hanno Böck <hanno@...eck.de>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request phpmyadmin (Fwd: XSS in phpMyadmin)
Am Dienstag 28 Oktober 2008 schrieb Thijs Kinkhorst:
> Do we still call things that require register_globals to be on a
> 'vulnerability'?
>
> Register_globals has been advertised (including in the PHP documentation
> of that option) as a very bad idea for many years now, it's turned off by
> default since years aswell. Turning it on could be considered as knowingly
> taking the risk on a certain class of exploits.
>
> At least Debian doesn't provide any security support for these issues.
I'd think this is okay as a policy for a distribution and agree that it's a
very bad idea to enable register_globals these days (afaik it should go away
in php6 anyway). But anyway a register_globals issue most likely leads to at
least some bad programming practise (using uninitalized variables), I think
it's okay to still track them.
And beside, would be worth a check but I am pretty sure there are still lot's
of webhosters out there having it enabled.
--
Hanno Böck Blog: http://www.hboeck.de/
GPG: 3DBD3B20 Jabber/Mail: hanno@...eck.de
http://x1000malquer.de/ - ab 8.11. Atomtransporte stoppen
Download attachment "signature.asc " of type "application/pgp-signature" (198 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
