RE: [PHP-DEV] Fwd: CHINANSL Security Advisory(CSA-200011)

Ok, time to notify bugtraq I guess? Or at least the poster. Zeev At 22:34 10/12/2000, James Moore wrote:

OK I found the key that had to be added in the registry. I tried with 1.3.17 and apache 1.3.6 and COULDNT reproduce this behaviour. James -----Original Message----- From: James Moore [mailto:jmoore@php.net] Sent: 10 December 2000 20:29 To: zeev@zend.com Cc: Jens Kristian Søgaard; php-dev@lists.php.net Subject: RE: [PHP-DEV] Fwd: CHINANSL Security Advisory(CSA-200011) Yep.. Just a basic cgi build of PHP.. that was file its just the apache end that I had problems. when trying to start the server I got the following error: D:\php3\apache>apache [Sun Dec 10 20:28:29 2000] [warn] Registry does not contain key SOFTWARE\Apache Group\Apache\1.3.6 fopen: No such file or directory D:\PHP3\APACHE\APACHE.EXE: could not open document config file /apache/conf/http d.conf James -----Original Message----- From: Zeev Suraski [mailto:zeev@zend.com] Sent: 10 December 2000 20:20 To: James Moore Cc: Jens Kristian Søgaard; php-dev@lists.php.net Subject: RE: [PHP-DEV] Fwd: CHINANSL Security Advisory(CSA-200011) I assume you tried it as a CGI...? At 22:15 10/12/2000, James Moore wrote: I tested on windows.. didnt work with php3 and apache 1.3.12, I couldnt get 1.3.6 to run due to registry problems.. Never build apache before and didnt know what registry patches it needs, if someone can tell me this then ill try. cheers James -----Original Message----- From: Zeev Suraski [mailto:zeev@zend.com] Sent: 10 December 2000 19:04 To: Jens Kristian Søgaard Cc: php-dev@lists.php.net Subject: Re: [PHP-DEV] Fwd: CHINANSL Security Advisory(CSA-200011) The exploit is only likely to work under Windows, as it relies on \ being a directory separator character. Did anybody test it under Windows? Zeev At 19:29 10/12/2000, Jens Kristian Søgaard wrote:

"Sterling Hughes" <Sterling.Hughes@pentap.net> writes:

The bug report says PHP3 though. Are you using php3 to test it?

PHP 3.0.11, Apache 1.3.3 on SunOS 5.7. The "exploit" had no effect here. -- Jens Kristian Søgaard, jk@soegaard.net -- http://www.jksoegaard.dk/ Søger du noget? -- http://www.google.com/ echo|perl -ple'$_+=4E-6*!int rand()**2+rand()**2while$i++-1E6' -- PHP Development Mailing List <http://www.php.net/> To unsubscribe, e-mail: php-dev-unsubscribe@lists.php.net For additional commands, e-mail: php-dev-help@lists.php.net To contact the list administrators, e-mail: php-list-admin@lists.php.net

-- Zeev Suraski <zeev@zend.com> CTO, Zend Technologies Ltd. http://www.zend.com/ -- PHP Development Mailing List <http://www.php.net/> To unsubscribe, e-mail: php-dev-unsubscribe@lists.php.net For additional commands, e-mail: php-dev-help@lists.php.net To contact the list administrators, e-mail: php-list-admin@lists.php.net -- PHP Development Mailing List <http://www.php.net/> To unsubscribe, e-mail: php-dev-unsubscribe@lists.php.net For additional commands, e-mail: php-dev-help@lists.php.net To contact the list administrators, e-mail: php-list-admin@lists.php.net -- Zeev Suraski <zeev@zend.com> CTO, Zend Technologies Ltd. http://www.zend.com/ -- PHP Development Mailing List <http://www.php.net/> To unsubscribe, e-mail: php-dev-unsubscribe@lists.php.net For additional commands, e-mail: php-dev-help@lists.php.net To contact the list administrators, e-mail: php-list-admin@lists.php.net -- PHP Development Mailing List <http://www.php.net/> To unsubscribe, e-mail: php-dev-unsubscribe@lists.php.net For additional commands, e-mail: php-dev-help@lists.php.net To contact the list administrators, e-mail: php-list-admin@lists.php.net -- PHP Development Mailing List <http://www.php.net/> To unsubscribe, e-mail: php-dev-unsubscribe@lists.php.net For additional commands, e-mail: php-dev-help@lists.php.net To contact the list administrators, e-mail: php-list-admin@lists.php.net

-- Zeev Suraski <zeev@zend.com> CTO, Zend Technologies Ltd. http://www.zend.com/