Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 28 Jun 2012 08:58:51 +0200
From: Matthias Weckbecker <>
Subject: Re: PHP information disclosure via easter egg ?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000

Hi Kurt,

On Thursday 28 June 2012 07:12:52 Kurt Seifried wrote:
> So simply querying:
> ?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000
> e.g.:
> shows authors, SAPI modules (and their authors) and normal modules
> (and their authors), resulting in a significant information disclosure
> (version #'s can be narrowed down from the authors list).
> This has already been reported, but no CVE was assigned:

Well, I don't think it should get one. expose_php is no news and so it is
expectable that it will make things like e.g. PHP's version number appear
in the HTTP response. Hiding it is security by obscurity and with the same 
argument you could say that it's a vulnerability that PHP's source code is
open source. IMHO.



PS: If such things happen regardless of expose_php's value it is of course
worth a CVE.

Matthias Weckbecker, Junior Security Engineer, SUSE Security Team
SUSE LINUX Products GmbH, Maxfeldstr. 5, D-90409 Nuernberg, Germany
Tel: +49-911-74053-0;
SUSE LINUX Products GmbH, GF: Jeff Hawn, HRB 16746 (AG Nuernberg) 

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.