RE: [PHP-QA] Fwd: CHINANSL Security Advisory(CSA-200011)

OK some results from my testing. An out of the box setup of PHP and Apache on win 32 (98) it isnt possible to do this. PHP throws an error of No input file specified (Even when the path is correct). They seem to be running Apache 1.3.6 (A very old version) under Win 2k. Ill see if I can get a copy of it and test under that enviroment. James -----Original Message----- From: James Moore [mailto:jmoore@php.net] Sent: 10 December 2000 10:21 To: php-qa@lists.php.net Subject: [PHP-QA] FW: [PHP-DEV] Fwd: CHINANSL Security Advisory(CSA-200011) Can people verify this behaviour at all. Its on windows apperently so Im testing now.. Ill post some feedback in a while. James -----Original Message----- From: Zeev Suraski [mailto:zeev@zend.com] Sent: 10 December 2000 00:08 To: php-dev@lists.php.net Subject: [PHP-DEV] Fwd: CHINANSL Security Advisory(CSA-200011) Has anybody taken a look at it? Zeev >Delivered-To: alias-zend-zeev@ZEND.COM >Approved-By: aleph1@SECURITYFOCUS.COM >Delivered-To: bugtraq@lists.securityfocus.com >Delivered-To: bugtraq@securityfocus.com >X-Mailer: Security Focus >Date: Wed, 6 Dec 2000 07:47:00 -0000 >Reply-To: webmaster@CHINANSL.COM >Sender: Bugtraq List <BUGTRAQ@SECURITYFOCUS.COM> >From: china nsl <webmaster@CHINANSL.COM> >Subject: CHINANSL Security Advisory(CSA-200011) >To: BUGTRAQ@SECURITYFOCUS.COM > > >CHINANSL Security Advisory(CSA-200011) > >Topic: PHP AND APACHE Vulnerability > >Release Date£º Dec 6, 2000 > >Affected system: >============ > >APACHE WEB SERVER 1.3 >¡¡¡¡- Microsoft Windows NT 4.0 >¡¡¡¡- Microsoft Windows 2000 >Impact: >====== > >CHINANSL security team has found a security >problem in Apache web server >where using php3. Exploitation of this vulnerability, A >malicious user >can access the content of file in the machine where >Apache web server >is runing. > >Description£º >========= > >For example (Windows 2000 + Apache 1.3.6 + >PHP3): > >http://taget/index.php3.%5c../..%5cconf/httpd.conf >You will get the httpd.conf file. > >Exploit: >===== > >run arbitrary command : > >http://taget/index.php3.%5c../..%5cconf/httpd.conf >You will get the httpd.conf file. > > >Solution: >======= > >None > >DISCLAIMS: >======== >THE INFORMATION PROVIDED IS RELEASED BY >CHINANSL "AS IS" WITHOUT WARRANTY OF ANY >KIND. CHINANSL DISCLAIMS ALL WARRANTIES, >EITHER EXPRESS OR IMPLIED, EXCEPT FOR >THE WARRANTIES OF MERCHANTABILITY. IN NO >EVENTSHALL CHINANSL BE LIABLE FOR ANY >DAMAGES WHATSOEVER INCLUDING DIRECT, >INDIRECT, INCIDENTAL,CONSEQUENTIAL, LOSS >OF BUSINESS PROFITS OR SPECIAL DAMAGES, >EVEN IF CHINANSL HAS BEEN ADVISED OF THE >POSSIBILITY OF SUCH DAMAGES. DISTRIBUTION >OR REPRODUTION OF THE INFORMATION IS >PROVIDED THAT THE ADVISORY IS NOT >MODIFIED IN ANY WAY. > >Copyright 1999-2000 CHINANSL. All Rights >Reserved. Terms of use. > >CHINANSL Security Team (http://www.chinansl.com) -- Zeev Suraski <zeev@zend.com> CTO, Zend Technologies Ltd. http://www.zend.com/ -- PHP Development Mailing List <http://www.php.net/> To unsubscribe, e-mail: php-dev-unsubscribe@lists.php.net For additional commands, e-mail: php-dev-help@lists.php.net To contact the list administrators, e-mail: php-list-admin@lists.php.net -- PHP Quality Assurance Mailing List <http://www.php.net/> To unsubscribe, e-mail: php-qa-unsubscribe@lists.php.net For additional commands, e-mail: php-qa-help@lists.php.net To contact the list administrators, e-mail: php-list-admin@lists.php.net