Re: Mambo, Coppermine and PHPBB Attacks

[ascii <ascii () katamail com>]

Yasuo Ohgaki wrote:
> OWASP guideline may be better to be updated, since allow_url_fopen=off
> is not practical and allow_url_fopen=off does not provide good enough safe guard.

good points

allow_url_fopen and many other functions try to do their best at the
application level

often php is uber hardened while cgi and exec are still allowed

so imho the best combination is:
 - try to solve the problem with php settings (url fopen, open basedir,
   exec dir, etc) and with apache (the favolous perchild concept :P)
 - set up some acl system like selinux or rsbac
 - set up grsec and use the group socket restrictions

is there somebody "developing" mpm-perchild?

too late for long emails,
Francesco 'ascii' Ongaro - http://www.ush.it/