Date: Thu, 28 Jun 2012 12:29:59 -0600 From: Kurt Seifried <kseifried@...hat.com> To: oss-security@...ts.openwall.com CC: Zeev Suraski <zeev@...d.com>, Stuart Henderson <stu@...cehopper.org>, "security@....net" <security@....net> Subject: Re: Re: PHP information disclosure via easter egg ?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 06/28/2012 07:24 AM, Zeev Suraski wrote: >> Would you expect a variable described as "Decides whether PHP may >> expose the fact that it is installed on the server" to control >> whether an anonymous user can fetch a list of enabled modules? > > I wouldn't, and thankfully it does not. The list you're seeing has > nothing to do with what's enabled or disabled on the server. It's > a build-time list of all the modules that were available in the > source tree. It's completely static for a given version of PHP. > As an example, in the abovementioned URL, you see NSAPI, ISAPI and > Apache 2.0 mentioned, although this is an Apache 1.3 server. We > also surely don't have COM and .NET installed on that Linux server > either. > > This is definitely not a security issue of any kind. > > Zeev > Yeah my bad, I just skimmed the list (it was late). Just for future reference as well the other magic values are: ext/standard/info.h:#define PHP_LOGO_GUID "PHPE9568F34-D428-11d2-A769-00AA001ACF42" ext/standard/info.h:#define PHP_EGG_LOGO_GUID "PHPE9568F36-D428-11d2-A769-00AA001ACF42" ext/standard/info.h:#define ZEND_LOGO_GUID "PHPE9568F35-D428-11d2-A769-00AA001ACF42" ext/standard/info.h:#define PHP_CREDITS_GUID "PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000" I guess I'm just not a huge fan of surprises in my software =). The expose_php variable appears to control them all no problem. - -- Kurt Seifried Red Hat Security Response Team (SRT) PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQIcBAEBAgAGBQJP7KKnAAoJEBYNRVNeJnmTBQMQAMnFQm+p8WjcsYUz+mWPewrS 4fV+c70bZU2kDOK8NOBwXWTluqxA43LQQBYP68HeDUmMAlwrZIgi20+myriXndD1 TDgMLpIImywMJentPpcgMHKNPUTW3a8pv4cde4tPUJVWkAIRPwY+yR3bhmnwhuq+ sPXo2bI5Ah+KNFQfn00hfi/s/NSOYBnCHD9CXezBYvZhNjXq+do8C3Zgv70DzOnh 9JR+v6s2iZUj37966GO4nV9+hMb0UW2SvT3qL8cgb5euNP3zF8loumJw0DHUgcoW +qcsw6rPTJbs2QSimw05gxrJe42BXYu0V+C8WC9Ov8JR+3p+fs/FCdf30RTDwtey 3jDFstGntBfGmak2XE8jk0i7m3Vp9WzmDKeoVM/uZZTJJ9hj0UazuDMJlklzz2UR aHCzBzxxWY8fmS38k9Po//o4wtb03Z1E2op/zoM10KvgKlmSCpawng22dLnWPtah XTchlIeUW+0/+XKBO6pKaXmdm+zxxUPNshouN2rQFEGtPK0fvgk1zZ1mj4CgHc8Z sJ222TdURBAzlHDg8l2bXoI3pkmxoH3yJ4bp8Caa5+Qf5tfnTu13bIi0MAQbJ6S8 lO3fFgxJ+U4k85RklS91jBb9XNG1qb4K+s3x7RzTKx29VsidlSYVrlWMcwwOxGU2 fHE5udqClQeTSJq6s8xg =Y6Z8 -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.