Date: Tue, 28 Aug 2012 12:03:34 -0600 From: Kurt Seifried <kseifried@...hat.com> To: oss-security@...ts.openwall.com CC: Sebastian Krahmer <krahmer@...e.de> Subject: Re: CVE-Request: apache2-mod_php5 AddHandler content confusion -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 08/28/2012 08:08 AM, Sebastian Krahmer wrote:> Hi, > > So far I have not seen any CVE for the recent "apache2-mod_php5 > remote code execution due to multiple extension feature of 'AddHandler's" > where you can treat a blah.php.gif as a PHP script due to sloppy > configs.  > > Can someone assign a CVE? At the quick look, I cant see who > actually discovered this. > > Sebastian > >  https://bugzilla.novell.com/show_bug.cgi?id=775852 This issue is not new, however the most recent reporter (this issue get "rediscovered" every once in a while) has been pushing it on Red Hat/etc, as previously discussed by RedHat/SuSE this is a documented issue and not really a security issue (in the sense that improper configuration plus poorly written PHP applications can cause security issues so "don't do that"), and it has been known for some time now (e.g. 2006 and earlier):  http://firstname.lastname@example.org/msg32365.html Generally speaking the solution has been to fix the apps that do not properly handle this (e.g. http://www.securityfocus.com/bid/18854). So unless something significant changes or new information comes to light this specific issue will probably not receive a CVE. - -- Kurt Seifried Red Hat Security Response Team (SRT) PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://www.enigmail.net/ iQIcBAEBAgAGBQJQPQf2AAoJEBYNRVNeJnmTlyEQAKrYqteEdbUnxXOAr72RA9yU jQ7IcheehRiVHGJd0U4/ekmdfxKcOVLAl6Ry7HtM7A+xyFoBBSrnnuTXMp5aobio 3w0aOhmqpjM0hmOOk3sdjZ/lhm367zbFF02l0TY4hoUbfHvG/pJxodgwgRrHAD+j kIVJlgsBI19YU/w4PxwTKM7Q6nwVpMivI3fo7FxL/5gLUne9ZcrYgv9HLsvn70vZ SYYkmVBv5Yjgl3lyi4BiAvkEDaa3ZmjyryPyOCM9RFgrIvqoiMdiwcDMMxNshKzl DSLoukb04gYzpl0TJuLV3Rxc6azy5JC8A6Z8tHO8c6Q5k9cbAhoOWtxiLw+bNa0c 3NDQf3a/ObC53Yx5d4+54JkKYyC9HSqOHBJB7UI5YnbD1QHaNDi1x9AL7dwzurLR lae+xEc3u8L+uVvXY8HNXTsdhHygrBvuo6GOGqmwP9SJRFWjuxIriAjwDuCtki5h Bwt/3irDr9O8wy60Nis7TjTP4pfDoIPydMzkXm9QEF1jbeND+uZ48T3cTUYNnuoc rODUET8NXBtFTmL+Rd8jTTfs36fvjAihIJp5iwTUC4YZmIcuIPJbePQWD4y0yckv tdrVTIcf5T9OHOuytBsWm61Ni99G91YPtjE8ZljXDYFAEKA/5qSouKW6ZxOA9XgV C8xQtVLDVarVrxW78BzD =2V5w -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.