Re: Nasty DoS in PHP
| From: | Dustin E. Childers | Date: | Thu, 18 Apr 2002 02:21:40 +0000 |
| Subject: | Re: Nasty DoS in PHP | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-93451@lists.php.net to get a copy of this message | ||
"If the user has enough access to the server to place files on it" ?
There are hosting places that have PHP and you can just upload the PHP
script through FTP and access it in your browser.
Dustin E. Childers
Security Administrator. CEO, Digitux Security, Inc.
http://www.digitux.net/
----- Original Message -----
From: "Jason Murray" <Jason.Murray@melbourneit.com.au>
To: "'Dustin E. Childers'" <dustin@acm.org>
Cc: <php-general@lists.php.net>
Sent: Wednesday, April 17, 2002 5:14 PM
Subject: RE: [PHP] Nasty DoS in PHP
> > It's a default PHP installation. We aren't calling set_time_limit().
> > I know its an infinite loop, the point is that if a user wanted to
> > attack a server (happens every day) they would be able to use this
> > method to take the server down.
>
> But, if the user has enough access to the server to place files on it,
> then they can do much, much worse stuff than running an infinite loop
> in PHP. Like I said, if it gets to that point you have bigger problems.
>
> Jason