full-disclosure - Bug with .php extension?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue Dec  6 10:43:29 2005
From: christopher.kunz at hardened-php.net (Christopher Kunz)
Subject: Bug with .php extension?

z3n wrote:
> Great Bug indeed!
> 
> But don't you think this issue is kind of similar to issue 3 in this
> (old) advisory:
> http://archives.neohapsis.com/archives/bugtraq/2003-01/0203.html
> 

Well, actually, I think this is some kind of "feature" and is associated with
the behavior that is i.e. demonstrated on default installations of Apache (which
 have several index.html index.html.de .en .jp etc.), only that this time not
mod_negotiation, but mod_mime is responsible.

--ck