Re: [cobalt-security] Cobalt Cube Webmail directory traversal (fwd)

["Steve Werby" <steve-lists@xxxxxxxxxxxx>]

"shimi" <shimi@xxxxxxxxxxxxxxxx> wrote:
> And in any case I am still correct... if a webserver has a server root, in
> no case the webserver shall send out a page on a directory upper than it's
> server root. That's only my opinion, though... (chroot was made for
> limiting software to the exact same thing)

And it's trivial for PHP to be configured to do the same.  See:
http://www.php.net/manual/en/configuration.php#ini.doc-root
http://www.php.net/manual/en/configuration.php#ini.open-basedir

And the exact exploit found by GTD was discussed in the last 2 days on
php-general under the thread "Security of PHP code".  Here's the first
message, follow the thread if you'd like.  It's probably a half dozen or
more messages before people post vulnerable URLs and code fixes.  Read the
whole thread b/c some of them aren't adequate.

--
Steve Werby
President, Befriend Internet Services LLC
http://www.befriend.com/