Full Disclosure mailing list archives
Re: GLSA: mod_php php
From: Stefan Esser <s.esser () e-matters de>
Date: Wed, 19 Feb 2003 15:41:17 +0100
Hi again, could you guys stop confusing the audience?
PACKAGE : mod_php php SUMMARY : arbitrary code execution DATE : 2003-02-19 13:28 UTC EXPLOIT : local
a) mod_php (if your package is really mod_php) is not vulnerable to the CGI vulnerability, because it is a vulnerability in the CGI version (this was clearly stated in our announcement) b) The announcement clearly states that this is a remote vulnerability. Yours, Stefan Esser -- -------------------------------------------------------------------------- Stefan Esser s.esser () e-matters de e-matters Security http://security.e-matters.de/ GPG-Key gpg --keyserver pgp.mit.edu --recv-key 0xCF6CAE69 Key fingerprint B418 B290 ACC0 C8E5 8292 8B72 D6B0 7704 CF6C AE69 -------------------------------------------------------------------------- Did I help you? Consider a gift: http://wishlist.suspekt.org/ -------------------------------------------------------------------------- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- GLSA: mod_php php Daniel Ahlberg (Feb 19)
- Re: GLSA: mod_php php Stefan Esser (Feb 19)