full-disclosure - Re: PHP fopen() CRLF Injection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.21.0209121828010.14466-100000@Tempo.Update.UU.SE>
From: ulfh at update.uu.se (Ulf Harnhammar)
Subject: Re: PHP fopen() CRLF Injection

This issue has now been fixed in their CVS repository. This is the
patch that they used:

http://cvs.php.net/diff.php/php4/ext/standard/url.c?r1=1.51&r2=1.52&ty=u&Horde=0

// Ulf Harnhammar
ulfh@...ate.uu.se
http://www.metaur.nu/


On Mon, 9 Sep 2002, Ulf Harnhammar wrote:

> PHP fopen() CRLF Injection
> 
> 
> SUMMARY:
> 
> fopen(), file() and other functions in PHP have a vulnerability
> that makes it possible to add extra HTTP headers to HTTP
> queries. Attackers may use it to escape certain restrictions,
> like what host to access on a web server. In some cases, this
> vulnerability even opens up for arbitrary net connections, turning
> some PHP scripts into proxies and open mail relays.