Bugtraq mailing list archives
Re: Re: [Full-disclosure] PHP import_request_variables() arbitrary variable overwrite
From: retrog () alice it
Date: 14 Mar 2007 01:36:04 -0000
[/quote] I can see why you weren't able to find anything. However, there have been a number of disclosures that are probably related - but these were grep-and-gripe affairs in third party applications, where the researcher didn't necessarily investigate *why* certain attacks worked. [/quote] let me say this: some of this entries are about vulnerabilities I discovered. Most of them are about a *misuse* of extract(), if specified with the EXTR_OVERWRITE flag or without flag (it's the same). Also EXTR_SKIP flag exists. So I considered a risky feature that some programmers misunderstood. Also php manual clearly says about the *security hazard*. *And* theese issues are very known to php exploiters for years, after Mr. Esser pointed attention to that. Now I go back to my grep 'n gripe affairs Andrea 'rgod' Micalizzi
Current thread:
- Re: [Full-disclosure] PHP import_request_variables() arbitrary variable overwrite Stefan Esser (Mar 10)
- Re: [Full-disclosure] PHP import_request_variables() arbitrary variable overwrite Stefano Di Paola (Mar 10)
- Re: [Full-disclosure] PHP import_request_variables() arbitrary variable overwrite Stefan Esser (Mar 10)
- Re: [Full-disclosure] PHP import_request_variables() arbitrary variable overwrite ascii (Mar 10)
- <Possible follow-ups>
- Re: [Full-disclosure] PHP import_request_variables() arbitrary variable overwrite Steven M. Christey (Mar 13)
- Re: Re: [Full-disclosure] PHP import_request_variables() arbitrary variable overwrite retrog (Mar 14)
- Re: [Full-disclosure] PHP import_request_variables() arbitrary variable overwrite Stefano Di Paola (Mar 10)