Date: Thu, 28 Jun 2012 08:58:51 +0200 From: Matthias Weckbecker <mweckbecker@...e.de> To: oss-security@...ts.openwall.com Subject: Re: PHP information disclosure via easter egg ?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000 Hi Kurt, On Thursday 28 June 2012 07:12:52 Kurt Seifried wrote: > So simply querying: > > ?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000 > > e.g.: > > http://php.net/?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000 > > shows authors, SAPI modules (and their authors) and normal modules > (and their authors), resulting in a significant information disclosure > (version #'s can be narrowed down from the authors list). > > This has already been reported, but no CVE was assigned: > Well, I don't think it should get one. expose_php is no news and so it is expectable that it will make things like e.g. PHP's version number appear in the HTTP response. Hiding it is security by obscurity and with the same argument you could say that it's a vulnerability that PHP's source code is open source. IMHO. [...] Matthias PS: If such things happen regardless of expose_php's value it is of course worth a CVE. -- Matthias Weckbecker, Junior Security Engineer, SUSE Security Team SUSE LINUX Products GmbH, Maxfeldstr. 5, D-90409 Nuernberg, Germany Tel: +49-911-74053-0; http://suse.com/ SUSE LINUX Products GmbH, GF: Jeff Hawn, HRB 16746 (AG Nuernberg)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.