Re: [cobalt-security] Cobalt Cube Webmail directory traversal (fwd)

["Steve Werby" <steve-lists@xxxxxxxxxxxx>]

"shimi" <shimi@xxxxxxxxxxxxxxxx> wrote:
> And in any case I am still correct... if a webserver has a server root, in
> no case the webserver shall send out a page on a directory upper than it's
> server root. That's only my opinion, though... (chroot was made for
> limiting software to the exact same thing)

And it's trivial for PHP to be configured to do the same.  See:
http://www.php.net/manual/en/configuration.php#ini.doc-root
http://www.php.net/manual/en/configuration.php#ini.open-basedir

And the exact exploit found by GTD was discussed in the last 2 days on
php-general under the thread "Security of PHP code".  Here's the first
message, follow the thread if you'd like.

[This time with message included <grin>]
http://marc.theaimsgroup.com/?l=php-general&m=99436630101256&w=2

It's probably a half dozen or more messages before people post
vulnerable URLs and code fixes.  Read the whole thread b/c some of
them aren't adequate.

--
Steve Werby
President, Befriend Internet Services LLC
http://www.befriend.com/