A note about PHP and path disclosure errors

From: rain forest puppy (rfp@wiretrip.net)
Date: 03/27/02 

Date: Tue, 26 Mar 2002 19:16:47 -0600 (CST)
From: rain forest puppy <rfp@wiretrip.net>
To: <bugtraq@securityfocus.com>, <vuln-dev@securityfocus.com>

In the last few weeks there have been many "give this malformed URL to
this PHP script, and it pukes with a full path error message" advisories.

I'd like to point out this is actually a PHP problem, and not the script.
Sure, it shouldn't be so easy to force the script to puke, but it's PHP
that's displaying the error message, not the script.

Thus, this boils down to a PHP configuration issue. If you look in your
php.ini file, you can turn off error reporting to the client and instead
send it to a local file. Sites that have taken the time to do this will
not find themselves vulnerable to this mild information disclosure. While
you're mucking around in your php.ini, considering turning off
register_globals and disabling furl_open_wrapper too.

IIS also does the same thing, particularly with ODBC error messages. If
you dig into your IIS site properties menus, you'll find a checkbox to
disable displaying error messages to the clients as well.

Cheers,
- rfp

Relevant Pages

  • Re: Unable to send mail ***caution Newbie**
    ... I get an error message "Fatal error: ... I have initializedPhpini file with Smtp address, ... Now in the below mentioned script there are fourmail.phpfiles here, ...
    (comp.lang.php)
  • Re: How to avoid Notice: Trying to get property of non-object
    ... Im new to PHP. ... In the script I've written, ... to get property of non-object in C:\Program Files\Apache Group ... The error message says that one or both of the objects or their ...
    (comp.lang.php)
  • Anybody who making a shared library for PHP in HP and IBM?
    ... I wanna use my dynamic shared librarywith php ... Php script can load my library successfully. ... in IBM environment: ... I don't know why above error message occur. ...
    (comp.lang.php)
  • Unable to send mail ***caution Newbie**
    ... I get an error message "Fatal error: ... I have initialized Php ini file with Smtp address, ... Now in the below mentioned script there are four mail.php files here, ...
    (comp.lang.php)
  • Re: [PHP] PHP console script vs C/C++/C#
    ... My script is taking a longer time to execute than I want. ... I prefer to write in PHP because that is what I know best. ... This is why I am thinking about rewriting my whole script in a C language. ... Perhaps there are different methods I could be using to speed up execution. ...
    (php.general)