>Successful exploitation requires that "register_globals= Off ".
That seems very strange, doesn't it?
Especially if you look at the source code.
Let's start with search.php, one of the vulnerable vectors:
<?php
...
require ("init.inc");
and in init.inc:
require ("globals.inc");
...
require ("$inc_dir/misc_func.$ext");
and in globals.inc:
if (defined("_GLOBALS")) return;
define('_GLOBALS', 1);
...
$inc_dir = 'include';
So - how could an attacker POSSIBLY modify the $inc_dir variable AFTER
it's set to a static value and when register_globals is off?
The answer is dynamic variable evaluation, which I posted about a
couple months ago at:
http://www.securityfocus.com/archive/1/432828
If we look more closely at globals.inc, later on, we see this:
if (!get_cfg_var("register_globals") ) {
include "include/register_globals.$ext";
}
and then if we look at register_globals.php, we see code like this:
if (isset($HTTP_GET_VARS)) {
reset($HTTP_GET_VARS);
while ( list($var, $val) = each($HTTP_GET_VARS) ) {
$$var=$val;
}
}
as well as for $HTTP_GET_VARS, $HTTP_POST_VARS, $HTTP_POST_FILES,
$HTTP_COOKIE_VARS.
This highlights the insidious nature of dynamic evaluation.
So - for those of us who have been questioning vulnerability reports
because we were seeing static values being set in include files - we
need to see if dynamic variable evaluation happens *after* the
variable is set, but *before* it's used.
Nasty, nasty stuff...
- Steve
