Re: [Full-Disclosure] [ GLSA 200402-01 ] PHP setting leaks from .htaccess files on virtual hosts

From: Sergei Golod (rover_at_tob.ru)
Date: 02/07/04

  • Next message: Ishikodzume: "Re: [Full-Disclosure] Gee Why don't you teach then! Help out the community."
    To: "Tim Yamin" <plasmaroo@gentoo.org>
    Date: Sat, 7 Feb 2004 12:31:26 +0500
    
    

    This bug was discussed at http://bugs.php.net/bug.php?id=25753.
    We are talking about same bug?

    ----- Original Message -----
    From: "Tim Yamin" <plasmaroo@gentoo.org>
    To: <bugtraq@securityfocus.com>; <full-disclosure@lists.netsys.com>;
    <security-alerts@linuxsecurity.com>; <gentoo-core@gentoo.org>;
    <gentoo-announce@gentoo.org>
    Sent: Saturday, February 07, 2004 6:02 AM
    Subject: [Full-Disclosure] [ GLSA 200402-01 ] PHP setting leaks from
    .htaccess files on virtual hosts

    > -----BEGIN PGP SIGNED MESSAGE-----
    > Hash: SHA1
    >
    > - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    > Gentoo Linux Security Advisory GLSA 200402-01
    > - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    > ~ http://security.gentoo.org
    > - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    >
    > ~ Severity: Normal
    > ~ Title: PHP setting leaks from .htaccess files on virtual hosts
    > ~ Date: February 07, 2004
    > ~ Bugs: #39952
    > ~ ID: 200402-01
    >
    > - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    >
    > Synopsis
    > ========
    >
    > If the server configuration "php.ini" file has "register_globals = on"
    > and a request is made to one virtual host (which has "php_admin_flag
    > register_globals off") and the next request is sent to the another
    > virtual host (which does not have the setting) through the same apache
    > child, the setting will persist. This may lead to leaks of global
    variables.
    >
    > Background
    > ==========
    >
    > PHP is a widely-used general-purpose scripting language that is
    > especially suited for Web development and can be embedded into HTML.
    >
    > Description
    > ===========
    >
    > If the server configuration "php.ini" file has "register_globals = on"
    > and a request is made to one virtual host (which has "php_admin_flag
    > register_globals off") and the next request is sent to the another
    > virtual host (which does not have the setting) through the same Apache
    > child, the setting will persist.
    >
    > Impact
    > ======
    >
    > Depending on the server and site, an attacker may be able to exploit
    > global variables to gain access to reserved areas, such as MySQL
    > passwords, or this vulnerability may simply cause a lack of
    > functionality. As a result, users are urged to upgrade their PHP
    > installations.
    >
    > Gentoo ships PHP with "register_globals" set to "off" by default.
    >
    > This issue affects both servers running Apache 1.x and servers running
    > Apache 2.x.
    >
    > Workaround
    > ==========
    >
    > No immediate workaround is available; a software upgrade is required.
    >
    > Resolution
    > ==========
    >
    > All users are recommended to upgrade their mod_php installation to
    4.3.4-r4:
    >
    > ~ # emerge sync
    > ~ # emerge -pv ">=dev-php/mod_php-4.3.4-r4"
    > ~ # emerge ">=dev-php/mod_php-4.3.4-r4"
    >
    > Concerns?
    > =========
    >
    > Security is a primary focus of Gentoo Linux and ensuring the
    > confidentiality and security of our users machines is of utmost
    > importance to us. Any security concerns should be addressed to
    > security@gentoo.org or alternatively, you may file a bug at
    > http://bugs.gentoo.org.
    >
    > -----BEGIN PGP SIGNATURE-----
    > Version: GnuPG v1.2.1 (GNU/Linux)
    > Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
    >
    > iD8DBQFAJDkqMMXbAy2b2EIRAhRMAJ9SDV/WHYdUDqADIp29JmqGeFQszQCdFvRV
    > nCYFaIKKbzwJKHa9IUa2fvk=
    > =SM5z
    > -----END PGP SIGNATURE-----
    >
    > _______________________________________________
    > Full-Disclosure - We believe in it.
    > Charter: http://lists.netsys.com/full-disclosure-charter.html
    >

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html


  • Next message: Ishikodzume: "Re: [Full-Disclosure] Gee Why don't you teach then! Help out the community."