Re: [Security-Discuss] Possible PHP hole in Perl?

On Tue, 2004-06-15 at 01:21, Bob [email protected] wrote:
> Hello Ronald,
> 
> At least in Mdk 8.2 and up, if you installed Apache and Apache-mod_perl, the Apache-mod_perl would 
> answer on port 8200.  I've got an app that runs in perl, and it runs much faster under the apache 
> mod_perl server.  Good stuff.
> 
> Now here's the problem: let's say you have a php file that accesses a database.  Within the php 
> file, you put the username/password for the database.  Normally, a user would never see this code, 
> as it is executed by the php processor called from Apache.  Let's say your file is called test.php. 
>   So if you browse: http://yourserver/test.php, you'll see the rendered page.  However, if you 
> browse http://yourserver:8200/test.php, it triggers a download of the actual (unrendered) php file, 
> comments and all.  Normally, one would not try to access a php file via the apache mod_perl, but I 
> just tried doing it on a bunch of machines here, and it does the above on all of them.
> 
> This could be a huge security leak.  I know at least for my scripts, it will reveal sql passwords, 
> and certain file paths.
> 
> For now, I've disabled the port 8200 on those sites.  But there must be some simple fix.
> 
> Bob

I'm a Java programmer rather than a PHP programmer, but if you're
putting sensitive information in your scripts then you are doing
something badly wrong. I would consider it a security hole just to have
it in there. 

Say for example your set-up was working perfectly, but then a new
exploit was found and before you had time to patch, someone got the raw
script file. The damage is twice as bad if usernames/passwords are in
there.

I don't know what alternative there is in PHP, but in Java you can put
that stuff in a config file that is not available in the normal download
path and it is encrypted in there as well.

Matt

-- 
http://www.mpcontracting.co.uk
Experts in Java development and website design

____________________________________________________
Want to buy your Pack or Services from MandrakeSoft? 
Go to http://www.mandrakestore.com
Join the Club : http://www.mandrakeclub.com
____________________________________________________