RE: [PHP-DEV] Fwd: CHINANSL Security Advisory(CSA-200011)

OK I found the key that had to be added in the registry. I tried with 1.3.17 and apache 1.3.6 and COULDNT reproduce this behaviour. James -----Original Message----- From: James Moore [mailto:jmoore@php.net] Sent: 10 December 2000 20:29 To: zeev@zend.com Cc: Jens Kristian Søgaard; php-dev@lists.php.net Subject: RE: [PHP-DEV] Fwd: CHINANSL Security Advisory(CSA-200011) Yep.. Just a basic cgi build of PHP.. that was file its just the apache end that I had problems. when trying to start the server I got the following error: D:\php3\apache>apache [Sun Dec 10 20:28:29 2000] [warn] Registry does not contain key SOFTWARE\Apache Group\Apache\1.3.6 fopen: No such file or directory D:\PHP3\APACHE\APACHE.EXE: could not open document config file /apache/conf/http d.conf James -----Original Message----- From: Zeev Suraski [mailto:zeev@zend.com] Sent: 10 December 2000 20:20 To: James Moore Cc: Jens Kristian Søgaard; php-dev@lists.php.net Subject: RE: [PHP-DEV] Fwd: CHINANSL Security Advisory(CSA-200011) I assume you tried it as a CGI...? At 22:15 10/12/2000, James Moore wrote: >I tested on windows.. didnt work with php3 and apache 1.3.12, I couldnt get >1.3.6 to run due to registry problems.. Never build apache before and didnt >know what registry patches it needs, if someone can tell me this then ill >try. > >cheers > >James > >-----Original Message----- >From: Zeev Suraski [mailto:zeev@zend.com] >Sent: 10 December 2000 19:04 >To: Jens Kristian Søgaard >Cc: php-dev@lists.php.net >Subject: Re: [PHP-DEV] Fwd: CHINANSL Security Advisory(CSA-200011) > > >The exploit is only likely to work under Windows, as it relies on \ being a >directory separator character. Did anybody test it under Windows? > >Zeev > >At 19:29 10/12/2000, Jens Kristian Søgaard wrote: > >"Sterling Hughes" <Sterling.Hughes@pentap.net> writes: > > > > > The bug report says PHP3 though. Are you using php3 to test it? > > > >PHP 3.0.11, Apache 1.3.3 on SunOS 5.7. The "exploit" had no effect > >here. > > > > > >-- > >Jens Kristian Søgaard, > >jk@soegaard.net -- http://www.jksoegaard.dk/ > >Søger du noget? -- http://www.google.com/ > >echo|perl -ple'$_+=4E-6*!int rand()**2+rand()**2while$i++-1E6' > > > >-- > >PHP Development Mailing List <http://www.php.net/> > >To unsubscribe, e-mail: php-dev-unsubscribe@lists.php.net > >For additional commands, e-mail: php-dev-help@lists.php.net > >To contact the list administrators, e-mail: php-list-admin@lists.php.net > >-- >Zeev Suraski <zeev@zend.com> >CTO, Zend Technologies Ltd. http://www.zend.com/ > > >-- >PHP Development Mailing List <http://www.php.net/> >To unsubscribe, e-mail: php-dev-unsubscribe@lists.php.net >For additional commands, e-mail: php-dev-help@lists.php.net >To contact the list administrators, e-mail: php-list-admin@lists.php.net > > >-- >PHP Development Mailing List <http://www.php.net/> >To unsubscribe, e-mail: php-dev-unsubscribe@lists.php.net >For additional commands, e-mail: php-dev-help@lists.php.net >To contact the list administrators, e-mail: php-list-admin@lists.php.net -- Zeev Suraski <zeev@zend.com> CTO, Zend Technologies Ltd. http://www.zend.com/ -- PHP Development Mailing List <http://www.php.net/> To unsubscribe, e-mail: php-dev-unsubscribe@lists.php.net For additional commands, e-mail: php-dev-help@lists.php.net To contact the list administrators, e-mail: php-list-admin@lists.php.net -- PHP Development Mailing List <http://www.php.net/> To unsubscribe, e-mail: php-dev-unsubscribe@lists.php.net For additional commands, e-mail: php-dev-help@lists.php.net To contact the list administrators, e-mail: php-list-admin@lists.php.net