Re: Re: PHP information disclosure via easter egg ?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000

[Kurt Seifried <kseifried () redhat com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 06/28/2012 07:24 AM, Zeev Suraski wrote:
> > Would you expect a variable described as "Decides whether PHP may
> > expose the fact that it is installed on the server" to control
> > whether an anonymous user can fetch a list of enabled modules?
>
> I wouldn't, and thankfully it does not.  The list you're seeing has
> nothing to do with what's enabled or disabled on the server.  It's
> a build-time list of all the modules that were available in the
> source tree.  It's completely static for a given version of PHP.
> As an example, in the abovementioned URL, you see NSAPI, ISAPI and
> Apache 2.0 mentioned, although this is an Apache 1.3 server.  We
> also surely don't have COM and .NET installed on that Linux server
> either.
>
> This is definitely not a security issue of any kind.
>
> Zeev

Yeah my bad, I just skimmed the list (it was late). Just for future
reference as well the other magic values are:

ext/standard/info.h:#define PHP_LOGO_GUID
"PHPE9568F34-D428-11d2-A769-00AA001ACF42"

ext/standard/info.h:#define PHP_EGG_LOGO_GUID
"PHPE9568F36-D428-11d2-A769-00AA001ACF42"

ext/standard/info.h:#define ZEND_LOGO_GUID
"PHPE9568F35-D428-11d2-A769-00AA001ACF42"

ext/standard/info.h:#define PHP_CREDITS_GUID
"PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000"

I guess I'm just not a huge fan of surprises in my software =). The
expose_php variable appears to control them all no problem.

- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQIcBAEBAgAGBQJP7KKnAAoJEBYNRVNeJnmTBQMQAMnFQm+p8WjcsYUz+mWPewrS
4fV+c70bZU2kDOK8NOBwXWTluqxA43LQQBYP68HeDUmMAlwrZIgi20+myriXndD1
TDgMLpIImywMJentPpcgMHKNPUTW3a8pv4cde4tPUJVWkAIRPwY+yR3bhmnwhuq+
sPXo2bI5Ah+KNFQfn00hfi/s/NSOYBnCHD9CXezBYvZhNjXq+do8C3Zgv70DzOnh
9JR+v6s2iZUj37966GO4nV9+hMb0UW2SvT3qL8cgb5euNP3zF8loumJw0DHUgcoW
+qcsw6rPTJbs2QSimw05gxrJe42BXYu0V+C8WC9Ov8JR+3p+fs/FCdf30RTDwtey
3jDFstGntBfGmak2XE8jk0i7m3Vp9WzmDKeoVM/uZZTJJ9hj0UazuDMJlklzz2UR
aHCzBzxxWY8fmS38k9Po//o4wtb03Z1E2op/zoM10KvgKlmSCpawng22dLnWPtah
XTchlIeUW+0/+XKBO6pKaXmdm+zxxUPNshouN2rQFEGtPK0fvgk1zZ1mj4CgHc8Z
sJ222TdURBAzlHDg8l2bXoI3pkmxoH3yJ4bp8Caa5+Qf5tfnTu13bIi0MAQbJ6S8
lO3fFgxJ+U4k85RklS91jBb9XNG1qb4K+s3x7RzTKx29VsidlSYVrlWMcwwOxGU2
fHE5udqClQeTSJq6s8xg
=Y6Z8
-----END PGP SIGNATURE-----