Date: Tue, 28 Oct 2008 10:50:17 +0200 From: Hanno Böck <hanno@...eck.de> To: oss-security@...ts.openwall.com Subject: Re: CVE request phpmyadmin (Fwd: XSS in phpMyadmin) Am Dienstag 28 Oktober 2008 schrieb Thijs Kinkhorst: > Do we still call things that require register_globals to be on a > 'vulnerability'? > > Register_globals has been advertised (including in the PHP documentation > of that option) as a very bad idea for many years now, it's turned off by > default since years aswell. Turning it on could be considered as knowingly > taking the risk on a certain class of exploits. > > At least Debian doesn't provide any security support for these issues. I'd think this is okay as a policy for a distribution and agree that it's a very bad idea to enable register_globals these days (afaik it should go away in php6 anyway). But anyway a register_globals issue most likely leads to at least some bad programming practise (using uninitalized variables), I think it's okay to still track them. And beside, would be worth a check but I am pretty sure there are still lot's of webhosters out there having it enabled. -- Hanno Böck Blog: http://www.hboeck.de/ GPG: 3DBD3B20 Jabber/Mail: hanno@...eck.de http://x1000malquer.de/ - ab 8.11. Atomtransporte stoppen Download attachment "signature.asc " of type "application/pgp-signature" (198 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.