Re: Fwd: CHINANSL Security Advisory(CSA-200011)

When I saw this "advisory", I thought "some stupid git is using a CGI version of PHP without any of the safety options enabled". - Stig James Moore wrote: > > OK some results from my testing. > > An out of the box setup of PHP and Apache on win 32 (98) it isnt possible to > do this. > PHP throws an error of No input file specified (Even when the path is > correct). They seem > to be running Apache 1.3.6 (A very old version) under Win 2k. Ill see if I > can get a > copy of it and test under that enviroment. > > James > > -----Original Message----- > From: James Moore [mailto:jmoore@php.net] > Sent: 10 December 2000 10:21 > To: php-qa@lists.php.net > Subject: [PHP-QA] FW: [PHP-DEV] Fwd: CHINANSL Security > Advisory(CSA-200011) > > Can people verify this behaviour at all. Its on windows apperently so Im > testing now.. > > Ill post some feedback in a while. > > James > > -----Original Message----- > From: Zeev Suraski [mailto:zeev@zend.com] > Sent: 10 December 2000 00:08 > To: php-dev@lists.php.net > Subject: [PHP-DEV] Fwd: CHINANSL Security Advisory(CSA-200011) > > Has anybody taken a look at it? > > Zeev > > >Delivered-To: alias-zend-zeev@ZEND.COM > >Approved-By: aleph1@SECURITYFOCUS.COM > >Delivered-To: bugtraq@lists.securityfocus.com > >Delivered-To: bugtraq@securityfocus.com > >X-Mailer: Security Focus > >Date: Wed, 6 Dec 2000 07:47:00 -0000 > >Reply-To: webmaster@CHINANSL.COM > >Sender: Bugtraq List <BUGTRAQ@SECURITYFOCUS.COM> > >From: china nsl <webmaster@CHINANSL.COM> > >Subject: CHINANSL Security Advisory(CSA-200011) > >To: BUGTRAQ@SECURITYFOCUS.COM > > > > > >CHINANSL Security Advisory(CSA-200011) > > > >Topic: PHP AND APACHE Vulnerability > > > >Release Date£º Dec 6, 2000 > > > >Affected system: > >============ > > > >APACHE WEB SERVER 1.3 > >¡¡¡¡- Microsoft Windows NT 4.0 > >¡¡¡¡- Microsoft Windows 2000 > >Impact: > >====== > > > >CHINANSL security team has found a security > >problem in Apache web server > >where using php3. Exploitation of this vulnerability, A > >malicious user > >can access the content of file in the machine where > >Apache web server > >is runing. > > > >Description£º > >========= > > > >For example (Windows 2000 + Apache 1.3.6 + > >PHP3): > > > >http://taget/index.php3.%5c../..%5cconf/httpd.conf > >You will get the httpd.conf file. > > > >Exploit: > >===== > > > >run arbitrary command : > > > >http://taget/index.php3.%5c../..%5cconf/httpd.conf > >You will get the httpd.conf file. > > > > > >Solution: > >======= > > > >None > > > >DISCLAIMS: > >======== > >THE INFORMATION PROVIDED IS RELEASED BY > >CHINANSL "AS IS" WITHOUT WARRANTY OF ANY > >KIND. CHINANSL DISCLAIMS ALL WARRANTIES, > >EITHER EXPRESS OR IMPLIED, EXCEPT FOR > >THE WARRANTIES OF MERCHANTABILITY. IN NO > >EVENTSHALL CHINANSL BE LIABLE FOR ANY > >DAMAGES WHATSOEVER INCLUDING DIRECT, > >INDIRECT, INCIDENTAL,CONSEQUENTIAL, LOSS > >OF BUSINESS PROFITS OR SPECIAL DAMAGES, > >EVEN IF CHINANSL HAS BEEN ADVISED OF THE > >POSSIBILITY OF SUCH DAMAGES. DISTRIBUTION > >OR REPRODUTION OF THE INFORMATION IS > >PROVIDED THAT THE ADVISORY IS NOT > >MODIFIED IN ANY WAY. > > > >Copyright 1999-2000 CHINANSL. All Rights > >Reserved. Terms of use. > > > >CHINANSL Security Team (http://www.chinansl.com) > > -- > Zeev Suraski <zeev@zend.com> > CTO, Zend Technologies Ltd. http://www.zend.com/ > > -- > PHP Development Mailing List <http://www.php.net/> > To unsubscribe, e-mail: php-dev-unsubscribe@lists.php.net > For additional commands, e-mail: php-dev-help@lists.php.net > To contact the list administrators, e-mail: php-list-admin@lists.php.net > > -- > PHP Quality Assurance Mailing List <http://www.php.net/> > To unsubscribe, e-mail: php-qa-unsubscribe@lists.php.net > For additional commands, e-mail: php-qa-help@lists.php.net > To contact the list administrators, e-mail: php-list-admin@lists.php.net > > -- > PHP Quality Assurance Mailing List <http://www.php.net/> > To unsubscribe, e-mail: php-qa-unsubscribe@lists.php.net > For additional commands, e-mail: php-qa-help@lists.php.net > To contact the list administrators, e-mail: php-list-admin@lists.php.net