Bug #13268 Updated: static path in php and mm

ID: 13268 Updated by: yohgaki Reported By: tomryan@camlaw.rutgers.edu Old Status: Assigned Status: Closed Bug Type: Session related Operating System: linux PHP Version: 4.0CVS-2001-09-12 Assigned To: yohgaki New Comment: Fixed in CVS Previous Comments: ------------------------------------------------------------------------ [2002-01-06 22:14:26] yohgaki@php.net Assign to myself ------------------------------------------------------------------------ [2001-12-19 22:37:49] yohgaki@php.net Will this be changed? Any one want me to fix it by adding addtional ini entry? ------------------------------------------------------------------------ [2001-09-12 13:57:13] tomryan@camlaw.rutgers.edu php (from 4.0.6 and the latest cvs code), has PS_MM_PATH statically defined in ext/session/mod_mm.c. This, coupled with hardcoding of only an extension in libmm.so, allows for a very easy DOS on systems that use session management for at least cgi and external binary placements for php, and quite possibly module installation. Is it produceable? sure.. touch /tmp/session_mm.sem (if using php and mm) ------------------------------------------------------------------------ Edit this bug report at http://bugs.php.net/?id=13268&edit=1