Bug #13268 Updated: static path in php and mm
| From: | yohgaki@php.net | Date: | Thu, 20 Dec 2001 03:37:49 +0000 |
| Subject: | Bug #13268 Updated: static path in php and mm | ||
| References: | 1 | Groups: | php.dev |
| Request: | Send a blank email to php-dev+get-74501@lists.php.net to get a copy of this message | ||
ID: 13268
Updated by: yohgaki
Reported By: tomryan@camlaw.rutgers.edu
Old Status: Open
Status: Analyzed
Bug Type: Session related
Operating System: linux
PHP Version: 4.0CVS-2001-09-12
New Comment:
Will this be changed?
Any one want me to fix it by adding addtional ini entry?
Previous Comments:
------------------------------------------------------------------------
[2001-09-12 13:57:13] tomryan@camlaw.rutgers.edu
php (from 4.0.6 and the latest cvs code), has PS_MM_PATH
statically defined in ext/session/mod_mm.c.
This, coupled with hardcoding of only an extension in
libmm.so, allows for a very easy DOS on systems that use
session management for at least cgi and external binary
placements for php, and quite possibly module installation.
Is it produceable? sure.. touch /tmp/session_mm.sem (if
using php and mm)
------------------------------------------------------------------------
Edit this bug report at http://bugs.php.net/?id=13268&edit=1