News for hackers. Stuff that matters.

A comment on Apache web server bug grants root access on shared hosting environments. Parent comment

Re:Apache web server bug grants root access on shared hostin... by hannob on Thursday April 04, 2019 @12:24PM (#19574152)
FWIW I reported it to PHPs bugtracker: https://bugs.php.net/bug.php?id=77843

I expect that it'll be fixed, not not handled as a security issue, as it doesn't fit within PHPs model of security vulns.

[ Parent | on HN ]
Re:Apache web server bug grants root access on shared hostin... by jimktrains2 on Thursday April 04, 2019 @12:31PM (#19574232)
> This looks like it requires specially crafted code, therefore not a security issue.

I'm not sure how I feel about such a response. Many exploits require odd, but valid code, and more often than not it exists out there.

Also, it feels weird for this to be tagged as a JSON issue?

[ Parent | on HN ]
Re:Apache web server bug grants root access on shared hostin... by jsight on Thursday April 04, 2019 @03:29PM (#19576204)
Basically they don't consider the engineer exploiting the interpreter to be a security vulnerability. That seems a bit dubious, but I can see where they are coming from in treating the script author as a trusted party.
[ Parent | on HN ]