RE: [PHP-DEV] Fwd: CHINANSL Security Advisory(CSA-200011)

Perhaps we should ask the poster about the version of php they are running and test it with that, but you could post to bug traq that we cannot reproduce it under these circumstances: Apache 1.3.6 PHP 3.0.17 Win 98/Win 2k James -----Original Message----- From: Zeev Suraski [mailto:zeev@zend.com] Sent: 10 December 2000 20:34 To: James Moore Cc: James Moore; Jens Kristian Søgaard; php-dev@lists.php.net Subject: RE: [PHP-DEV] Fwd: CHINANSL Security Advisory(CSA-200011) Ok, time to notify bugtraq I guess? Or at least the poster. Zeev At 22:34 10/12/2000, James Moore wrote: >OK I found the key that had to be added in the registry. > >I tried with 1.3.17 and apache 1.3.6 and COULDNT reproduce this behaviour. > >James > >-----Original Message----- >From: James Moore [mailto:jmoore@php.net] >Sent: 10 December 2000 20:29 >To: zeev@zend.com >Cc: Jens Kristian Søgaard; php-dev@lists.php.net >Subject: RE: [PHP-DEV] Fwd: CHINANSL Security Advisory(CSA-200011) > > >Yep.. Just a basic cgi build of PHP.. that was file its just the apache end >that >I had problems. when trying to start the server I got the following error: > >D:\php3\apache>apache >[Sun Dec 10 20:28:29 2000] [warn] Registry does not contain key >SOFTWARE\Apache >Group\Apache\1.3.6 >fopen: No such file or directory >D:\PHP3\APACHE\APACHE.EXE: could not open document config file >/apache/conf/http >d.conf > >James > >-----Original Message----- >From: Zeev Suraski [mailto:zeev@zend.com] >Sent: 10 December 2000 20:20 >To: James Moore >Cc: Jens Kristian Søgaard; php-dev@lists.php.net >Subject: RE: [PHP-DEV] Fwd: CHINANSL Security Advisory(CSA-200011) > > >I assume you tried it as a CGI...? > >At 22:15 10/12/2000, James Moore wrote: > >I tested on windows.. didnt work with php3 and apache 1.3.12, I couldnt get > >1.3.6 to run due to registry problems.. Never build apache before and didnt > >know what registry patches it needs, if someone can tell me this then ill > >try. > > > >cheers > > > >James > > > >-----Original Message----- > >From: Zeev Suraski [mailto:zeev@zend.com] > >Sent: 10 December 2000 19:04 > >To: Jens Kristian Søgaard > >Cc: php-dev@lists.php.net > >Subject: Re: [PHP-DEV] Fwd: CHINANSL Security Advisory(CSA-200011) > > > > > >The exploit is only likely to work under Windows, as it relies on \ being a > >directory separator character. Did anybody test it under Windows? > > > >Zeev > > > >At 19:29 10/12/2000, Jens Kristian Søgaard wrote: > > >"Sterling Hughes" <Sterling.Hughes@pentap.net> writes: > > > > > > > The bug report says PHP3 though. Are you using php3 to test it? > > > > > >PHP 3.0.11, Apache 1.3.3 on SunOS 5.7. The "exploit" had no effect > > >here. > > > > > > > > >-- > > >Jens Kristian Søgaard, > > >jk@soegaard.net -- http://www.jksoegaard.dk/ > > >Søger du noget? -- http://www.google.com/ > > >echo|perl -ple'$_+=4E-6*!int rand()**2+rand()**2while$i++-1E6' > > > > > >-- > > >PHP Development Mailing List <�fk< > > >��K�lc����http://www.php.net/> > > >To unsubscribe, e-mail: php-dev-unsubscribe@lists.php.net > > >For additional commands, e-mail: php-dev-help@lists.php.net > > >To contact the list administrators, e-mail: php-list-admin@lists.php.net > > > >-- > >Zeev Suraski <zeev@zend.com> > >CTO, Zend Technologies Ltd. http://www.zend.com/ > > > > > >-- > >PHP Development Mailing List <http://www.php.net/> > >To unsubscribe, e-mail: php-dev-unsubscribe@lists.php.net > >For additional commands, e-mail: php-dev-help@lists.php.net > >To contact the list administrators, e-mail: php-list-admin@lists.php.net > > > > > >-- > >PHP Development Mailing List <http://www.php.net/> > >To unsubscribe, e-mail: php-dev-unsubscribe@lists.php.net > >For additional commands, e-mail: php-dev-help@lists.php.net > >To contact the list administrators, e-mail: php-list-admin@lists.php.net > >-- >Zeev Suraski <zeev@zend.com> >CTO, Zend Technologies Ltd. http://www.zend.com/ > > >-- >PHP Development Mailing List <http://www.php.net/> >To unsubscribe, e-mail: php-dev-unsubscribe@lists.php.net >For additional commands, e-mail: php-dev-help@lists.php.net >To contact the list administrators, e-mail: php-list-admin@lists.php.net > > >-- >PHP Development Mailing List <http://www.php.net/> >To unsubscribe, e-mail: php-dev-unsubscribe@lists.php.net >For additional commands, e-mail: php-dev-help@lists.php.net >To contact the list administrators, e-mail: php-list-admin@lists.php.net > > >-- >PHP Development Mailing List <http://www.php.net/> >To unsubscribe, e-mail: php-dev-unsubscribe@lists.php.net >For additional commands, e-mail: php-dev-help@lists.php.net >To contact the list administrators, e-mail: php-list-admin@lists.php.net -- Zeev Suraski <zeev@zend.com> CTO, Zend Technologies Ltd. http://www.zend.com/