full-disclosure - Re: php-exec-dir vulnerable after latest upgrade

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.44.0407080937500.24679-100000@mutant.kyberdigi.cz>
From: mccohy at kyberdigi.cz (C. McCohy)
Subject: Re: php-exec-dir vulnerable after latest upgrade

So, finally I have identified the problem, which was in fact, that the
construction used for calling a command via the backtick operator did not
use the php_escape_shell_cmd() internal function, which escapes some
'ugly/unwanted' characters, like '&', ';', '|' and others. This function
is already used if the command is called via exec(), system() or popen()
functions, so these were not vulnerable.

New patches for all versions are available on the project homepage
http://kyebrdigi.cz/projects/execdir

--
Baj ... C. McCohy

While you are reading this text, an essential hacking tool
is being silently installed on your computer.