RE: [PHP-CVS] cvs: php4 /sapi/cgi cgi_main.c
| From: | James Cox | Date: | Fri, 10 May 2002 06:38:33 +0000 |
| Subject: | RE: [PHP-CVS] cvs: php4 /sapi/cgi cgi_main.c | ||
| References: | 1 | Groups: | php.cvs |
| Request: | Send a blank email to php-cvs+get-11806@lists.php.net to get a copy of this message | ||
Nothing here is particularly relevant when dealing with this exploit.
I would suggest reading the url pointed at by shane in cgi_main.c at about
line 500 (+/- 100 lines) which explains the exploit in depth before going
any further.
I admit i'm not the world's greatest c/c++ programmer, but between shane and
I and an hour of ICQ, we couldn't find anything to latch on to that was SAPI
indescriminate (ie, from Apache to IIS, to PWS, to AOL Server, to
Xitami..... [and then anything on unix that uses cgi php......])
James