Re: Mambo, Coppermine and PHPBB Attacks

[Paul Laudanski <zx () castlecops com>]

On Tue, 20 Dec 2005, Tofik Suleymanov wrote:

>  From php.ini
> "Whether to allow the treatment of URLs (like http:// or ftp://) as files."
>
> In latest versions of php this option is set to secure mode of operation 
> by default (as far as i know):
> allow_url_fopen = Off
> This option prevents such type of attacks.

Just so that we can set the record straight I checked the manual at 
php.net.

Reference: http://us2.php.net/filesystem

allow_url_fopen by default is set to On.

-- 
Paul Laudanski, Microsoft MVP Windows-Security
[cal] http://events.castlecops.com
[de] http://de.castlecops.com
[en] http://castlecops.com
[wiki] http://wiki.castlecops.com
[family] http://cuddlesnkisses.com