At 12:10 PM 8/22/2001, Tom Malone wrote:
read the advisory - everything is explained.
~kurth
This is not an issue if you're site is using Apache, correct?
Tom Malone
Web Designer
http://www.tom-malone.com
-Original Message-
From: Kurth Bemis [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, August 22, 2001 11:13 AM
To: [EMAIL PROTECTED]
Subject: [PHP] Fwd: BadBlue v1.02 beta for Windows 98, ME and 2000 .php
Source Code Disclosure Vulnerability
Thought this may be of interest to somebody.
~kurth
Delivered-To: [EMAIL PROTECTED]
Mailing-List: contact [EMAIL PROTECTED]; run by ezmlm
List-Id: vuln-dev.list-id.securityfocus.com
List-Post: mailto:[EMAIL PROTECTED]
List-Help: mailto:[EMAIL PROTECTED]
List-Unsubscribe: mailto:[EMAIL PROTECTED]
List-Subscribe: mailto:[EMAIL PROTECTED]
Delivered-To: mailing list [EMAIL PROTECTED]
Delivered-To: moderator for [EMAIL PROTECTED]
From: acz [iSecureLabs] [EMAIL PROTECTED]
To: [EMAIL PROTECTED], [EMAIL PROTECTED]
Cc: [EMAIL PROTECTED]
Subject: BadBlue v1.02 beta for Windows 98, ME and 2000 .php Source Code
Disclosure Vulnerability
Date: Wed, 22 Aug 2001 11:11:28 +0200
X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0)
Importance: Normal
-- [ iSecureLabs BadBlue v1.02 beta for Windows 98, ME and 2000
Advisory ] --
BadBlue v1.02 beta for Windows 98, ME and 2000 .php Source Code Disclosure
Vulnerability
Problem discovered: 22/08/2001
-- [ Overview ] --
BadBlue http://badblue.com/ is a tiny, free download that lets you share
files, search other
PCs and even run powerful web applications.
Badblue support .php extension.
It is possible to retrieve full .php source code.
-- [ Description ] --
Badblue contains an input validation vulnerability which may lead to
download the full source code of .php pages.
This is due to a lack of checks for NULL bytes.
Exemple:
http://myBadBlue.com/test.php%00
Note: It is possible too to download .dll file used by BadBlue.
Exmeple:
http://myBadBlue.com/ext.dll%00
-- [ Tested Version ] --
BadBlue v1.02 beta for Windows 98, ME and 2000
-- [ Discovered by ] --
Cabezon Aurelien | [EMAIL PROTECTED]
http://www.iSecureLabs.com | French Security portal
http://www.isecurelabs.com/advisory/badblue.html
--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
To contact the list administrators, e-mail: [EMAIL PROTECTED]
--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
To contact the list administrators, e-mail: [EMAIL PROTECTED]
--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
To contact the list administrators, e-mail: [EMAIL PROTECTED]