Re: Rumours about Apache 1.3.22 exploits

[Mike Tone <simpletone () mbox com au>]

One quick thing we should get straight... 

PHP has problems, on the win32 platform (apache 1.3.x)...

but on *nix as well??  

--snip-from-bugware
PHP for windows arbitrary files execution (feb2002)

SYSTEMS AFFECTED
PHP version 4.1.1 under Windows
PHP version 4.0.4 under Windows
        
PROBLEM
CompuMe and RootExtractor posted :

An attacker can upload innocent looking files  (with  mp3,  txt  or  gif
extensions) through any uploading systems such as  WebExplorer  (or  any
other PHP program that has uploading  capabilities),  and  then  request
PHP to execute it.
--snap


as for bind issues (i have nfi), blame non-disclosure.


---------------------------------------------------------------------
Never lose a fax again, receive faxes to your personal email account!
Visit http://www.mbox.com.au/fax