[PHP-DEV] [defacementmonitor@hotmail.com: Win ME, Apache/1.3.20 and PHP/4.0.4pl1 Source disclosure Vulnerability]

2001-12-15 Thread Markus Fischer
Hi, This mail just poppep up buqtrag. Although PHP 4.0.4pl1 is old and it is unlikely someone is running it on a production machine on Win ME I'ld like someone with access to Win ME and standard Apache/PHP installation can verify this is true or not. Not only PHP

Re: [PHP-DEV] [defacementmonitor@hotmail.com: Win ME, Apache/1.3.20 and PHP/4.0.4pl1 Source disclosure Vulnerability]

2001-12-15 Thread Zeev Suraski
As I responded on Bugtraq, this is, if anything, an Apache bug, not a PHP bug. It could be a configuration bug too, but the bottom line is the Apache doesn't determine that the file is a PHP file when requested in that way, and doesn't even invoke PHP on it. Zeev At 02:42 16/12/2001, Markus