bugtraq - Re: Re: [Full-disclosure] PHP import_request_variables() arbitrary variable overwrite

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20070314013604.18698.qmail@securityfocus.com>
Date: 14 Mar 2007 01:36:04 -0000
From: retrog@...ce.it
To: bugtraq@...urityfocus.com
Subject: Re: Re: [Full-disclosure] PHP import_request_variables()
 arbitrary variable overwrite

[/quote]
I can see why you weren't able to find anything. However, there have
been a number of disclosures that are probably related - but these
were grep-and-gripe affairs in third party applications, where the
researcher didn't necessarily investigate *why* certain attacks
worked.

[/quote]

let me say this: some of this entries are about vulnerabilities
I discovered. Most of them are about a *misuse* of extract(),
if specified with the EXTR_OVERWRITE flag or without flag (it's the same).
Also EXTR_SKIP flag exists. 

So I considered a risky feature that some programmers misunderstood. 
Also php manual clearly says about the *security hazard*. *And* 
theese issues are very known to php exploiters for years, after
Mr. Esser pointed attention to that.

Now I go back to my grep 'n gripe affairs

Andrea 'rgod' Micalizzi