php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #14883 Remote vulnerability allows access to ALL files on webserver
Submitted: 2002-01-06 02:12 UTC Modified: 2002-02-28 20:53 UTC
Votes:5
Avg. Score:5.0 ± 0.0
Reproduced:5 of 5 (100.0%)
Same Version:3 (60.0%)
Same OS:4 (80.0%)
From: pbtech at cornell dot edu Assigned:
Status: Closed Package: Other web server
PHP Version: 4.1.1 OS: Windows NT (all Win32)
Private report: No CVE-ID: None
View Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
If you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: pbtech at cornell dot edu
New email:
PHP Version: OS:

 

 [2002-01-06 02:12 UTC] pbtech at cornell dot edu 
Report yesterday (4 Jan 02) at http://www.securiteam.com/windowsntfocus/5ZP030U60U.html outlines the security hole.  I have tested it on NT4, Apache 1.3.9, PHP 4.0.4 and then upgraded to NT4, Apache 1.3.22, PHP 4.1.1 and the problem remains.  I've been monitoring the PHP newsgroups (announcements and Windows user lists) since the vulnerability was announced and searched the buglist but haven't found mention of it anywhere.

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2002-02-28 06:28 UTC] paul at whichone dot net 
Actually, this exploit allows anyone to gain root access to the Machine and so the severity should be ugraded to High.
 [2002-02-28 19:54 UTC] yohgaki@php.net 
I think document is updated so that users can set up Apache corretly, right?
(Not yet?)
 [2002-02-28 19:59 UTC] shane at caraveo dot com 
The problem can be avoided by setting doc_root in php.ini.  Meanwhile, I've submitted a quick patch to cvs.  Working right now on a full patch.
Shane
 [2002-02-28 20:04 UTC] alindeman@php.net 
Not a doc prob...RTFM

http://www.php.net/manual/en/security.cgi-bin.php
 [2002-02-28 20:32 UTC] yohgaki@php.net 
I just would like to make sure if document in source is ok also.
Could anyone check it?

And I would like to open this report since shane@caraveo.com is willing
to write patch for this :)

Could you change Category to Apache problem after checking doc in source?
 [2002-02-28 20:53 UTC] yohgaki@php.net 
Shane has already commited the fix to CVS :)
 [2002-02-28 20:59 UTC] shane at caraveo dot com 
It's still not a full solution.  PHP is going out by default with a big hole, and most users will not read that part of the docs to figure out that PHP CGI has that hole.  The patch I've now submitted turns on FORCE_REDIRECT by default, but it can be turned off (IIS for example needs it off) in the php.ini file.
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved. 		Last updated: Sat Mar 15 08:01:29 2025 UTC