Full Disclosure mailing list archives
Re: Critical PHP bug - act ASAP if you are running web with sensitive data
From: Valdis.Kletnieks () vt edu
Date: Wed, 29 Mar 2006 10:36:05 -0500
On Wed, 29 Mar 2006 02:40:49 CST, nocfed said:
Right, that is a vector that nobody knows about unless they have common sense. There were previous bugs with text editor(s) which used logfiles to push the payload. Why someone would ever decide to include parsable logfiles directly into a script is beyond me, and I'm sure is even beyond the kid that has been tinkering around the crap known as php, a god awful scripting language, for but a single day.
You're almost, but not quite right - the crucial point you slid right past is that it's "nobody knows about unless they have common sense *and* *a* *reason* *to* *be* *security* *conscious*". It's a subtle point that those *in* the security industry have a hard time remembering. Things like SQL injections happen because the guy who wrote the code and forgot to sanitize the input string is in a certain mindset at the time. He is *not* thinking "I better be careful that some hacker from whatever they're calling Yugoslavia this decade doesn't get in". He's thinking "the boss wants this new web reporting system working by next Friday". So he never tests whether the page blows up if it sees apostrophe semicolon more SQL statements, because what's *supposed* to be in that field is a phone number, and phone numbers never have apostrophes. And he's too busy worrying about things like "some people enter 555 1212 and some enter 555-1212 and some enter 212-555-1212 and some enter +1 (212) 555-1212 and there's one guy in the Hong Kong office that killed the *last* system when he put in some string that didn't have 7, 10, or 11 numeric digits, it was like 15, and all of it has to be converted to one format for the database...."
Attachment:
_bin
Description:
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Critical PHP bug - act ASAP if you are running web with sensitive data Tõnu Samuel (Mar 28)
- Re: Critical PHP bug - act ASAP if you are running web with sensitive data nocfed (Mar 29)
- Re: Critical PHP bug - act ASAP if you are running web with sensitive data Valdis . Kletnieks (Mar 29)
- Re: Critical PHP bug - act ASAP if you are running web with sensitive data nocfed (Mar 29)