full-disclosure - Re: [WEB SECURITY] Re: Global Space Exploitation In PHP Based Web Applications

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <460EC0D5.1060002@metaeye.org>
Date: Sun, 01 Apr 2007 01:43:09 +0530
From: Aditya K Sood <zeroknock@...aeye.org>
To: Michal Zalewski <lcamtuf@...ne.ids.pl>, 
	full-disclosure@...ts.grok.org.uk,  websecurity@...appsec.org
Subject: Re: [WEB SECURITY] Re: Global Space Exploitation
 In PHP Based Web Applications

Michal Zalewski wrote:
> On Sat, 31 Mar 2007, Aditya K Sood wrote:
>
>   
>> http://zeroknock.metaeye.org/analysis/gspace.xhtml
>>     
>
> Just like your previous "double trap" XSS advisory, I fail to see the
> novelty or significance of this report.
>
> You seem to discuss an ages-old issue that had been used to exploit a
> countless number of web applications, and is remediated by disabling
> register_globals (ain't that off by default since PHP 4.2.0?).
>
> /mz
>
> ----------------------------------------------------------------------------
> Join us on IRC: irc.freenode.net #webappsec
>
> Have a question? Search The Web Security Mailing List Archives: 
> http://www.webappsec.org/lists/websecurity/
>
> Subscribe via RSS: 
> http://www.webappsec.org/rss/websecurity.rss [RSS Feed]
>
>
>   
Well
                                         Nothing seems to be old. If  
it  is  still persisting
with different layout than the attack vector is till persisting. It depends
up on individual to look at the significance.

There are number of people who finds it significant. I dont want to point
it out but it comes in my and I thought its need attention again.Even after
the specifier is off but still the vector is there may be due to any reason.

Rest it depends on ones thinking. It needs attention again.

Regards
Adi

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/