Re: PHP4 vulnerabilities
* Allard Hoeve:
> Dear debian-security,
>
> Please take note of bugs:
>
> - #361853: [CVE-2006-0996] phpinfo() Cross Site Scripting
> - #361855: [CVE-2006-1494] tempnam() open_basedir bypass
> - #361856: [CVE-2006-1608] copy() Safe Mode Bypass
>
> All of which seem to affect sarge.
phpinfo should be disabled on production servers. IIRC, it's even
documented in the manual.
The other two bugs can only be exploited by malicious PHP scripts. By
design, mod_php4 cannot defend against such scripts, so these bugs
have very, very low priority.
Reply to: