bugtraq - Re: Path Disclosure in Turba of Horde

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20030517184657.GA16153@fork>
Date: Sat, 17 May 2003 19:47:00 +0100
From: Anil Madhavapeddy <anil@...oil.org>
To: Lorenzo Manuel Hernandez Garcia-Hierro <security@...enzohgh.com>
Subject: Re: Path Disclosure in Turba of Horde

On Sat, May 17, 2003 at 01:18:59PM -0000, Lorenzo Manuel Hernandez Garcia-Hierro wrote:
> 
> There is a path disclosure in status.php of Turba module at Horde 2.1,
> you get this:
> 
> Fatal error: Call to a member function on a non-object 
> in /opt/local/apache/htdocs/horde/turba/status.php on line 12
> 
> NOTE: i observed that this only occur in Turba....

This is a bit of a silly advisory ... the recommended production
deployment for PHP is to point run-time error logging to a file,
and not the script output.

Have a look at the 'display_errors' and 'log_errors' entries
in your php.ini.  Once you set these appropriately, any PHP errors
(including the above) will be safely stored in a log-file for the
admin to look at.

Anil