[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20120628131544.GT27619@symphytum.spacehopper.org>
Date: Thu, 28 Jun 2012 14:15:44 +0100
From: Stuart Henderson <stu@...cehopper.org>
To: oss-security@...ts.openwall.com
Cc: Kurt Seifried <kseifried@...hat.com>, security@....net
Subject: Re: Re: PHP information disclosure via easter egg
?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000
On 2012/06/28 12:34, Johannes Schlüter wrote:
> Hi,
>
> On Wed, 2012-06-27 at 23:12 -0600, Kurt Seifried wrote:
> > http://php.net/?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000
> >
> > shows authors, SAPI modules (and their authors) and normal modules
> > (and their authors), resulting in a significant information disclosure
> > (version #'s can be narrowed down from the authors list).
>
> I have barely seen attackers actually trying to figure out the version
> number. 99% are directly trying to exploit known vectors using some
> scripts. And to get the version number there's a way simpler way, also
> controlled using the same php.ini setting:
>
> $ echo "HEAD / HTTP/1.0\n" | nc www.php.net 80 | grep PHP
> Server: Apache/1.3.41 (Unix) PHP/5.2.17
> X-Powered-By: PHP/5.2.17
Would you expect a variable described as "Decides whether PHP may
expose the fact that it is installed on the server" to control
whether an anonymous user can fetch a list of enabled modules?
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
