From owner-freebsd-security Thu Feb 28 2:55:17 2002 Delivered-To: freebsd-security@freebsd.org Received: from mailhub.unibe.ch (mailhub.unibe.ch [130.92.9.52]) by hub.freebsd.org (Postfix) with ESMTP id B3C8C37B402 for ; Thu, 28 Feb 2002 02:55:14 -0800 (PST) Received: from CONVERSION-DAEMON.mailhub.unibe.ch by mailhub.unibe.ch (PMDF V6.1 #40086) id <0GS800001P01Z2@mailhub.unibe.ch> for freebsd-security@freebsd.org; Thu, 28 Feb 2002 11:55:13 +0100 (MET) Received: from iamexwi.unibe.ch (haegar.unibe.ch [130.92.63.4]) by mailhub.unibe.ch (PMDF V6.1 #40086) with ESMTP id <0GS800EEGP01BJ@mailhub.unibe.ch> for freebsd-security@freebsd.org; Thu, 28 Feb 2002 11:55:13 +0100 (MET) Received: from klee.unibe.ch (klee [130.92.63.36]) by iamexwi.unibe.ch (8.9.3+Sun/8.8.8) with ESMTP id LAA24680 for ; Thu, 28 Feb 2002 11:55:13 +0100 (MET) Received: (from roth@localhost) by klee.unibe.ch (8.10.2+Sun/8.10.2) id g1SAtAA21796 for freebsd-security@freebsd.org; Thu, 28 Feb 2002 11:55:10 +0100 (MET) Date: Thu, 28 Feb 2002 11:55:10 +0100 From: Tobias Roth Subject: Re: PHP 4.1.1 security bug In-reply-to: <"from melange"@yip.org> To: freebsd-security@freebsd.org Message-id: <20020228115510.A21754@klee.unibe.ch> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline User-Agent: Mutt/1.2.5.1i References: <"from mitayai"@dreamlabs.com> <20020227152720.G40253@yip.org> Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org > On Wed, Feb 27, 2002 at 01:11:23PM -0500, Mit Rowe wrote: > > Ref: > > http://www.php.net > > http://security.e-matters.de/advisories/012002.html > > The advisory mentions a workaround (Recommendation) for php4 > (file_uploads in php.ini), but nothing for php3 - does anyone know if > there is something that can be done for that besides disabling it? > (until it's finished recompiling, I mean) I tried this workaround, but I don't know if everything is ok: with file_uploads = On, phpinfo() shows file_uploads = 1 with file_uploads = Off, phpinfo() shows file_uploads = no value so is 'no value' OK? I'd rather see a 'Off' instead cheers, T. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message