[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 28 Jun 2012 08:58:51 +0200
From: Matthias Weckbecker <mweckbecker@...e.de>
To: oss-security@...ts.openwall.com
Subject: Re: PHP information disclosure via easter egg ?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000
Hi Kurt,
On Thursday 28 June 2012 07:12:52 Kurt Seifried wrote:
> So simply querying:
>
> ?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000
>
> e.g.:
>
> http://php.net/?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000
>
> shows authors, SAPI modules (and their authors) and normal modules
> (and their authors), resulting in a significant information disclosure
> (version #'s can be narrowed down from the authors list).
>
> This has already been reported, but no CVE was assigned:
>
Well, I don't think it should get one. expose_php is no news and so it is
expectable that it will make things like e.g. PHP's version number appear
in the HTTP response. Hiding it is security by obscurity and with the same
argument you could say that it's a vulnerability that PHP's source code is
open source. IMHO.
[...]
Matthias
PS: If such things happen regardless of expose_php's value it is of course
worth a CVE.
--
Matthias Weckbecker, Junior Security Engineer, SUSE Security Team
SUSE LINUX Products GmbH, Maxfeldstr. 5, D-90409 Nuernberg, Germany
Tel: +49-911-74053-0; http://suse.com/
SUSE LINUX Products GmbH, GF: Jeff Hawn, HRB 16746 (AG Nuernberg)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
