Re: Potential server security risk

The thing you are talking about does not imply a security hole in PHP itself. PHP is of course capable of sending out 8GB of data if the server has the memory and enough time... BTW this email address is not the appropriate forum for asking support questions. For a list of more appropriate places to ask for help using PHP, please visit http://php.net/support Thank you for your interest in PHP. Goba [one webmaster@php.net] ----- Original Message ----- From: Teaching Treasures Mail To: webmaster@php.net Sent: Wednesday, December 18, 2002 5:13 AM Subject: Potential server security risk Dear Webmaster. My web host is accusing me of "Blowing Up" their server and taking up 8 Gbytes of space to e-mail 8 GBytes worth of log data, caused by a PHP script I wrote and executed on their server. I can't see how my little PHP script could have caused such damage, and was wondering whether or not you could confirm my web host's accusations. The web host does not provide adequate log statistics, the raw access.log file they provide only gives access to the current day's log statistics in gzip format, I needed to write a PHP script to extract the relevant data from this file each day and append it to a data file. Currently daily access.log filesize does not exceed 10KB. I set a cron job to execute this script every day at midnight, and since my host clears this file every day, the time I set may have caused a conflict with their task, they tell me that it brought down their entire server (possibly because of a Round Robin effect, Im gessing because the tech people at the server end refuse to let me know what went wrong) . I know how busy you must be and know that this problem is not really your concern, but since this may be a security hole I thought it might be of some interest to you. Would it be possible for you to take a look at my program. Please tell me whether it could be capable of e-mailing 8 GB of data, clogging up 8 GB of server space and also blowing up the server? Warning: If my script does what my host says it does, you may want to take some precautions if you decide to test it. The following line, is how I set as the cron job: 0 0 * * * php /home/able-ed/public_html/logs/log.php I found out afterwards that my web host runs PHP as an apache module, not compiled as CGI, so would the cron job I specified have anything to do with it? If you are unable to test if my program causes the suggested problems, could you please recommend where I could get it tested? Thank you for your valuable time. Kind regards, Daniel Griggs. treasures@westrnet.com.au P.S. The attached file is a duplicate 'now with comments' to the one that supposedly caused so much damage.