OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: [suse-security] cgi-bin/printenv
From: alex medvedev (alexmpycckue.org)
Date: Sat Apr 08 2000 - 19:24:43 CDT

hallo,

just wondering why the PATH variable changes after reloading the printenv
script?
Example:
i requested http://localhost/cgi-bin/printenv
i got lots of stuff back including:
PATH = /bin:/usr/bin:/usr/ucb:/usr/bsd:/usr/local/bin
reload the browser:
PATH = /sbin:/bin:/usr/sbin:/usr/bin
reload again:
PATH = /bin:/usr/bin:/usr/ucb:/usr/bsd:/usr/local/bin
moreover the PATH does not change consistently after each reload.
it is on suse 6.1:
SERVER_SOFTWARE = Apache/1.3.6 (Unix) (SuSE/Linux) PHP/3.0.7 mod_perl/1.19
mod_ssl/2.2.8 SSLeay/0.9.0b
is that a security feature :)

-alexm the bandwidthwaister

---------------------------------------------------------------------
To unsubscribe, e-mail: suse-security-unsubscribesuse.com
For additional commands, e-mail: suse-security-helpsuse.com