[30174] in bugtraq
Re: Path Disclosure in Turba of Horde
daemon@ATHENA.MIT.EDU (Anil Madhavapeddy)
Sat May 17 16:10:59 2003
Date: Sat, 17 May 2003 19:47:00 +0100
From: Anil Madhavapeddy <anil@recoil.org>
To: Lorenzo Manuel Hernandez Garcia-Hierro <security@lorenzohgh.com>
Message-ID: <20030517184657.GA16153@fork>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20030517131859.19724.qmail@www.securityfocus.com>
On Sat, May 17, 2003 at 01:18:59PM -0000, Lorenzo Manuel Hernandez Garcia-Hierro wrote:
>
> There is a path disclosure in status.php of Turba module at Horde 2.1,
> you get this:
>
> Fatal error: Call to a member function on a non-object
> in /opt/local/apache/htdocs/horde/turba/status.php on line 12
>
> NOTE: i observed that this only occur in Turba....
This is a bit of a silly advisory ... the recommended production
deployment for PHP is to point run-time error logging to a file,
and not the script output.
Have a look at the 'display_errors' and 'log_errors' entries
in your php.ini. Once you set these appropriately, any PHP errors
(including the above) will be safely stored in a log-file for the
admin to look at.
Anil
