Re: Possible DoS? (was: Recusive Include()s crash system)
| From: | Teodor Cimpoesu | Date: | Sun, 08 Oct 2000 14:03:06 +0000 |
| Subject: | Re: Possible DoS? (was: Recusive Include()s crash system) | ||
| References: | 1 | Groups: | php.dev |
| Request: | Send a blank email to php-dev+get-34469@lists.php.net to get a copy of this message | ||
Hi haroldp!
On Sun, 08 Oct 2000, haroldp@internal.org wrote:
> From: haroldp@internal.org
> Operating system: FreeBSD 4.0-STABLE
> PHP version: 4.0.2
> PHP Bug Type: Reproduceable crash
> Bug description: Recusive Include()s crash system
>
> Include()ing a file that Include()s itself - ie, a recusive
> Include() - will completely crash a system. Not just the
> web server, it ran my box out of swap in a few seconds
> and required a power cycle.
>
> Could we get some sanity checking on this? I had a
> web designer's *typo* bring a ssytem to its knees.
>
I tested it too on RH6.2 and CPU went to 60% and mem. to 90%, swap
wasting pretty quick.
Note it can be a possible DoS attack agains sites offering PHP.
This also reminds me of something similar:
$fd = fopen ('file_doesnt_exits','r');
while (!feof($fd)) {
// do stuff
}
filled error logs with warnings wasting entire disk space.
Of couse, this all are programming mistakes, but these should be
a way to defend them.
-- teodor