ID: 14883 Updated by: [EMAIL PROTECTED] Reported By: [EMAIL PROTECTED] -Status: Bogus +Status: Open Bug Type: Documentation problem Operating System: Windows NT (all Win32) PHP Version: 4.1.1 New Comment:
I just would like to make sure if document in source is ok also. Could anyone check it? And I would like to open this report since [EMAIL PROTECTED] is willing to write patch for this :) Could you change Category to Apache problem after checking doc in source? Previous Comments: ------------------------------------------------------------------------ [2002-02-28 20:04:08] [EMAIL PROTECTED] Not a doc prob...RTFM http://www.php.net/manual/en/security.cgi-bin.php ------------------------------------------------------------------------ [2002-02-28 19:59:34] [EMAIL PROTECTED] The problem can be avoided by setting doc_root in php.ini. Meanwhile, I've submitted a quick patch to cvs. Working right now on a full patch. Shane ------------------------------------------------------------------------ [2002-02-28 19:54:24] [EMAIL PROTECTED] I think document is updated so that users can set up Apache corretly, right? (Not yet?) ------------------------------------------------------------------------ [2002-02-28 06:28:04] [EMAIL PROTECTED] Actually, this exploit allows anyone to gain root access to the Machine and so the severity should be ugraded to High. ------------------------------------------------------------------------ [2002-01-06 02:12:42] [EMAIL PROTECTED] Report yesterday (4 Jan 02) at http://www.securiteam.com/windowsntfocus/5ZP030U60U.html outlines the security hole. I have tested it on NT4, Apache 1.3.9, PHP 4.0.4 and then upgraded to NT4, Apache 1.3.22, PHP 4.1.1 and the problem remains. I've been monitoring the PHP newsgroups (announcements and Windows user lists) since the vulnerability was announced and searched the buglist but haven't found mention of it anywhere. ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=14883&edit=1
