RE: [PHP-DEV] ooops, i thought it new one but:

Moshe, It's quite difficult to exploit this vulnerability without knowing your servers setup. It is possible, but personally I wouldn't worry too much about it although you should urge your ISP to upgrade to 4.0.4pl1. Andi At 08:07 PM 1/27/2001 +0000, James Moore wrote:

No. the bug was localised after the release of PHP 4.0.4 that is the reason why we released the Security Advisory and PHP 4.0.4pl1 so if you think that your servers could be affected you SHOULD upgrade to PHP 4.0.4pl1. It affects ALL versions of PHP 4 up to PHP 4.0.4, you should read the Advisory carefully and see the corresponding posts on Bugtraq for further information. Security Focus is currently down but check on securityfocus.com next week and read about it. Basically:

        Issues only affect mod_php4 in apache

        => The issue that php_value engine off can propagate
           from virtual host to virtual host can be easy worked
           around by adding php_value engine on to your DEFAULT
           server config in httpd.conf.

        => The second issue where php directives can be set
           from request to request has questionable real world
           use but is still a security issue. IIRC you can
           prevent this to a certain extent by disallowing
           OPTIONS requests in your httpd.conf

Doing the above will not guarantee that your system is safe but it will enable you check the security advisory and then make a decision on whether an upgrade is necessary. James -- James Moore PHP Quality Assurance Team jmoore@php.net -----Original Message----- From: moshe doron [mailto:mosdoron@netvision.net.il] Sent: 27 January 2001 19:30 To: php-dev@lists.php.net Subject: [PHP-DEV] ooops, i thought it new one but: in debian, they say this bug affecting also 3pl1, but its not what i fount on php.net. can i be relexed if the servers i using runing 3pl1? -- "Rasmus Lerdorf" <rasmus@php.net> wrote in message news:Pine.LNX.4.30.0101271111410.888-100000@localhost.localdomain...

pl2? This advisory has been out for over a week and the

problem is fixed

in 4.0.4pl1 -Rasmus On Sat, 27 Jan 2001, moshe doron wrote:

the problem here is, that i have problem to update some servers

contains my

code coz them not in my ownship, so i just have to test if this bug

affected

them (if yep i'll temply remove the the file from the server) but no explains. does that subject stay in darken till monday not to give hackers the

chance

to exploite it during the weekend? btw, ll' there official php4.0.4pl2 on php.net that time? tnx moshe. -- "Rasmus Lerdorf" <rasmus@php.net> wrote in message news:Pine.LNX.4.30.0101271045540.888-100000@localhost.localdomain...

The reference is right in the link you posted. Just upgrade to the

latest

version to address it. On Sat, 27 Jan 2001, moshe doron wrote:

http://freshmeat.net/news/2001/01/27/980597363.html where can i find any references? tnx moshe. -- -- PHP Development Mailing List <http://www.php.net/> To unsubscribe, e-mail: php-dev-unsubscribe@lists.php.net For additional commands, e-mail: php-dev-help@lists.php.net To contact the list administrators, e-mail:

php-list-admin@lists.php.net

-- PHP Development Mailing List <http://www.php.net/> To unsubscribe, e-mail: php-dev-unsubscribe@lists.php.net For additional commands, e-mail: php-dev-help@lists.php.net To contact the list administrators, e-mail:

php-list-admin@lists.php.net

-- PHP Development Mailing List <http://www.php.net/> To unsubscribe, e-mail: php-dev-unsubscribe@lists.php.net For additional commands, e-mail: php-dev-help@lists.php.net To contact the list administrators, e-mail:

php-list-admin@lists.php.net

-- PHP Development Mailing List <http://www.php.net/> To unsubscribe, e-mail: php-dev-unsubscribe@lists.php.net For additional commands, e-mail: php-dev-help@lists.php.net To contact the list administrators, e-mail: php-list-admin@lists.php.net

-- PHP Development Mailing List <http://www.php.net/> To unsubscribe, e-mail: php-dev-unsubscribe@lists.php.net For additional commands, e-mail: php-dev-help@lists.php.net To contact the list administrators, e-mail: php-list-admin@lists.php.net -- PHP Development Mailing List <http://www.php.net/> To unsubscribe, e-mail: php-dev-unsubscribe@lists.php.net For additional commands, e-mail: php-dev-help@lists.php.net To contact the list administrators, e-mail: php-list-admin@lists.php.net