Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:15780
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
	s=beta; d=gmail.com;
	h=received:message-id:date:from:reply-to:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:references;
	b=PjUuGZ/tuvwxQbTyM1uLIBcswRdW/RAYdTHgAXu4gZfCLFd+d3Mt3kh4TxmxNz4Lm44hZkM083zGeAT9uMDzrEmPzcUcbSl3/epMO9jb+tl0PPMr6d+yUXf1TJDn/yXYz+Hx4Bw6CVXVZET/TVDYcx2Y3fdjZn7wI8VocU1fSZY=
Message-ID: <4e89b426050403215076f5448e@mail.gmail.com>
Date: Sun, 3 Apr 2005 23:50:47 -0500
Reply-To: Wez Furlong <kingwez@gmail.com>
To: Mark Krenz <mark@suso.org>
Cc: internals@lists.php.net
In-Reply-To: <20050404043233.GV32563@arvo.suso.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
References: <20050404043233.GV32563@arvo.suso.org>
Subject: Re: [PHP-DEV] Should I report this bug/exploit?
From: kingwez@gmail.com (Wez Furlong)

Please send details to security@php.net for further analysis.

--Wez.

On Apr 3, 2005 11:32 PM, Mark Krenz <mark@suso.org> wrote:
> 
>   Hi,  I've been using PHP for a long time and have recently found a
> couple of major bugs that would allow pretty much any user on a shared
> web hosting server to read other user's files.  The conditions for this
> exploit are quite common.   Also, from what I can tell, this exploit
> would not be very easy to fix and in fact may not be fixable until a
> peruser MPM for Apache is completely ready (Like perchild or Metux).
> It could be that you already know about this problem but have also not
> reported it.  I couldn't find any other information about it from doing
> some searches.
> 
>   This leads me to wonder, is it a good idea to make this vulnerability
> known?  On the one hand, releasing the information would allow admins
> and developers to try to fix it, but on the other hand, if its not
> immediately fixable it would allow for a large window of opportunity for
> attacks.  Thus, I came to this list for some advice on what I should do.
> Maybe I could at least email one of your privately so that you can see
> what it is.
> 
> Thanks,
> 
> Mark
> 
> --
> Mark S. Krenz
> IT Director
> Suso Technology Services, Inc.
> http://suso.org/
> 
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: http://www.php.net/unsub.php
> 
>