#19120 [Opn]: Open-relay PHP script using unfiltered data on mail()
| From: | derick@php.net | Date: | Tue, 27 Aug 2002 09:34:35 +0000 |
| Subject: | #19120 [Opn]: Open-relay PHP script using unfiltered data on mail() | ||
| References: | 1 | Groups: | php.bugs |
| Request: | Send a blank email to php-bugs+get-17923@lists.php.net to get a copy of this message | ||
ID: 19120
Updated by: derick@php.net
Reported By: vogel@folz.de
Status: Open
Bug Type: Mail related
Operating System: Linux (or any Unix)
PHP Version: 4.2.2
New Comment:
The first issue is fixed already, and will be in version 4.2.3 (due in
a few weeks).
IIRC the second issue is also fixed, but I'm not totally sure.
Previous Comments:
------------------------------------------------------------------------
[2002-08-27 05:27:51] vogel@folz.de
Well, I'm not the person who found this, I just
want to have this reported here.
A few days ago Wojciech Purczynski <cliph@isec.pl>
reported a security problem with the mail()
function to bugtraq, see:
http://online.securityfocus.com/archive/1/288804
I must admit that I haven't checked the validity
of his claims. But because there is still no
reply from anyone to his email on bugtraq, I figured
it should be reported here.
------------------------------------------------------------------------
--
Edit this bug report at http://bugs.php.net/?id=19120&edit=1