#19120 [Opn->Bgs]: Open-relay PHP script using unfiltered data on mail()

ID: 19120 Updated by: sesser@php.net Reported By: vogel@folz.de -Status: Open +Status: Bogus Bug Type: Mail related Operating System: Linux (or any Unix) PHP Version: 4.2.2 New Comment: Please do not submit the same bug more than once. An existing bug report already describes this very problem. Even if you feel that your issue is somewhat different, the resolution is likely to be the same. Because of this, we hope you add your comments to the original bug instead. Thank you for your interest in PHP. Previous Comments: ------------------------------------------------------------------------ [2002-08-27 05:34:34] derick@php.net The first issue is fixed already, and will be in version 4.2.3 (due in a few weeks). IIRC the second issue is also fixed, but I'm not totally sure. ------------------------------------------------------------------------ [2002-08-27 05:27:51] vogel@folz.de Well, I'm not the person who found this, I just want to have this reported here. A few days ago Wojciech Purczynski <cliph@isec.pl> reported a security problem with the mail() function to bugtraq, see: http://online.securityfocus.com/archive/1/288804 I must admit that I haven't checked the validity of his claims. But because there is still no reply from anyone to his email on bugtraq, I figured it should be reported here. ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=19120&edit=1