bugtraq - Re: PHP ip2long() function circumvention

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20060729214314.22066.qmail@securityfocus.com>
Date: 29 Jul 2006 21:43:14 -0000
From: darylf@...rter.net
To: bugtraq@...urityfocus.com
Subject: Re: PHP ip2long() function circumvention

I think you should have reported this as a MiniBB vulnerability (and I'm assuming you have).
I don't know if I would really classify this as an issue with the PHP function, though it may require looking into. I recently discovered similar behavior in Windows resolving applications. I can't be certain that the Windows resolver itself is the culprit, as I haven't tested (maybe one of you would like to do so), but when using the "/dns" command in mIRC, a tab and other special characters as an argument (preceding valid input data) seems to return the local host name.
I'm not sure whether that's expected behavior, but it's very similar to this, only less relevant to the security of a particular application.