[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: function sleep() in all versions of PHP
- To: bugtraq@xxxxxxxxxxxxxxxxx
- Subject: Re: function sleep() in all versions of PHP
- From: cxib@xxxxxxxxxxxxxxxxxx
- Date: 27 May 2008 10:44:00 -0000
Yeap.
?Using PHP as an in-process script interpreter grants script authors control
over the httpd children.?
It is possible to make DoS (block all sockets/memory exe.). (more in Xploit
magazin)
Reason: Use PHP via a CGI interpreter with RLimit* directives.
Anyone how use PHP as an in-process script interpreter, can be dangerous.
Best Regards,
Maksymilian Arciemowicz
securityreason.com
http://securityreason.com/key/Arciemowicz.Maksymilian.gpg