bugtraq - Re: PHP Advanced Transfer Manager v1.20 ; Multiple Remote File Include Vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <200609142247.k8EMlLZe022917@faron.mitre.org>
Date: Thu, 14 Sep 2006 18:47:21 -0400 (EDT)
From: "Steven M. Christey" <coley@...re.org>
To: l0x3@...mail.com
Cc: bugtraq@...urityfocus.com, ceilers-lists@....de
Subject: Re: PHP Advanced Transfer Manager v1.20 ; Multiple Remote File Include Vulnerabilities

l0x3@...mail.com,

There have been many vulnerability reports like this, and they don't
seem to make sense.

You are the first one to say that you actually tested it, and it
worked.  Because you called it 'weird', you also clearly understand
that this does not make sense.

Maybe it's a bug in a very specific version or distribution of PHP.
If so, then it is a very serious bug.  But clearly, it is not in most
distributions of PHP, because many people can not reproduce it.

So, that's why it is important for you to tell us the PHP version, the
web server and version, operating system (maybe even hardware), and
all output from phpinfo().  If there's really a problem, it could be
anywhere.

Thank you,
Steve

P.S. my personal bet is a concurrency/threading error when there are a
few simultaneously loaded modules on a 64-bit multi-processor machine
and only supporting certain non-English languages.  *if* there's
really a problem :)