Re: security issue with mail()

We run so it only accept connections from localhost, and send the mails through the port, we don't call the app correctly. my system/security guru tells me it's because spawning sendmail like that is dangerous (it sets uid as root) made sense to me :) -a -- Alex Black, Head Monkey enigma@turingstudio.com The Turing Studio, Inc. http://www.turingstudio.com vox+510.666.0074 fax+510.666.0093 Saul Zaentz Film Center 2600 Tenth St Suite 433 Berkeley, CA 94710-2522 > From: richard@zend.com ("Richard Lynch") > Organization: Zend Technologies > Newsgroups: php.general > Date: 5 Dec 2000 19:55:47 -0800 > Subject: Re: [PHP] security issue with mail() > >> I tried to create a formmail in PHP (as my first proggie) and the server >> returned a warning like that: >> "mail() has been disabled for security reasons" >> so I contacted my webhost and they said mail() has been disabled because >> it has a security flaw. >> It allows the PHP script to access any file on the server including other >> virtual hosts. >> Is that true?? > > I think it more likely that they disabled all the file functions for that > reason, and mail() so you can't send spam. > > I don't *think* mail() would allow you to access any file whatsoever... > > What they may not realize is that you can *maybe* use something like Manuel > Lemos' class to "talk" directly to their mail server port 25 and send email > that way, bypassing PHP's builtin mail() function entirely. OTOH, if they > were smart enough and vigilant enough to disable the file and mail() > functions, they may have their port 25 locked down somehow to block you as > well, or disabled the socket functions in PHP. > > On the plus side, you have an ISP who obviously cares enough about security > to do something about it... > > Still, if you *need* mail(), you may need to consider another ISP or > co-locating your own server set up the way *you* want it. > > If budget is your primary concern, try http://php.net/links.php > (two links > to databases of PHP ISP's listed) or > http://www.budgetweb.com for price and > feature based searches, but no PHP-specific flag last time I checked :-( > > > > -- > PHP General Mailing List (http://www.php.net/) > To unsubscribe, e-mail: php-general-unsubscribe@lists.php.net > For additional commands, e-mail: php-general-help@lists.php.net > To contact the list administrators, e-mail: php-list-admin@lists.php.net >