[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 28 Oct 2008 09:43:17 +0100 (CET)
From: "Thijs Kinkhorst" <thijs@...ian.org>
To: oss-security@...ts.openwall.com
Cc: coley@...re.org
Subject: Re: CVE request phpmyadmin (Fwd: XSS in phpMyadmin)
On Mon, October 27, 2008 23:28, Hanno Böck wrote:
> No fix yet, works also in 3.0.1.
Do we still call things that require register_globals to be on a
'vulnerability'?
Register_globals has been advertised (including in the PHP documentation
of that option) as a very bad idea for many years now, it's turned off by
default since years aswell. Turning it on could be considered as knowingly
taking the risk on a certain class of exploits.
At least Debian doesn't provide any security support for these issues.
Thijs
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Powered by Openwall GNU/*/Linux -
Powered by OpenVZ
