Re: Interesting webserver intrusion (apache 1.3.31, mod_ssl 2.8.18, php 4.3.7)

[Dmitry Alyabyev <dimitry () al org ua>]

On Saturday 10 July 2004 04:40, Tim Greer wrote:

[skip]

> Sounds like one of the many PHP scripts is exploitable.  You could run
> PHP as CGI w/ the suexec wrapper (and even tweak the source or use an
> existing patch so PHP scripts don't need to be modified at all (other
> than the ownership of some files/dirs PHP scripts need to use/write to).

not really - you will lose authentication within PHP scripts in meaning of 
receiving password via environment and some add-ons like Zend optimizer will 
stop working

-- 
Dimitry