Re: Should I report this bug/exploit?

Please send details to security@php.net for further analysis. --Wez. On Apr 3, 2005 11:32 PM, Mark Krenz <mark@suso.org> wrote: > > Hi, I've been using PHP for a long time and have recently found a > couple of major bugs that would allow pretty much any user on a shared > web hosting server to read other user's files. The conditions for this > exploit are quite common. Also, from what I can tell, this exploit > would not be very easy to fix and in fact may not be fixable until a > peruser MPM for Apache is completely ready (Like perchild or Metux). > It could be that you already know about this problem but have also not > reported it. I couldn't find any other information about it from doing > some searches. > > This leads me to wonder, is it a good idea to make this vulnerability > known? On the one hand, releasing the information would allow admins > and developers to try to fix it, but on the other hand, if its not > immediately fixable it would allow for a large window of opportunity for > attacks. Thus, I came to this list for some advice on what I should do. > Maybe I could at least email one of your privately so that you can see > what it is. > > Thanks, > > Mark > > -- > Mark S. Krenz > IT Director > Suso Technology Services, Inc. > http://suso.org/ > > -- > PHP Internals - PHP Runtime Development Mailing List > To unsubscribe, visit: http://www.php.net/unsub.php > >