bugtraq - Re: Re: [Full-disclosure] Apache suEXEC privilege elevation / information disclosure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Tue, 13 Aug 2013 12:26:47 +0200
From: "Marco Floris" <marco.floris@...meria.org>
To: "coderaptor" <coderaptor@...il.com>,
  "Reindl Harald" <h.reindl@...lounge.net>
Cc: "bugtraq@...urityfocus.com" <bugtraq@...urityfocus.com>
Subject: Re: Re: [Full-disclosure] Apache suEXEC privilege elevation / information disclosure

In my opinion we got two problems about that.

In some cases tools are user unfriendly. And a bit cryptic...but surely the sysadmin have to take care of it.

the other question is: the human guilt. Let's assume that the problem is not Apache or PHP. If i shoot my foot with my gun...the problem is not the gun.

Let's also assume that many people aren't not so smart and didn't like to read about or keep informed. Definetly they aren't sysadmin but...in many cases

they work as well in this role.

We are talking about security (aren't we?) so the first problem is the human element.

ps

PHP is a great scripting language, very useful and powerful but isn't used in a creative way at all. PHP only for web develompent? it's a real pity.

--
marco floris