From owner-freebsd-hackers Mon Mar 10 10:59:55 2003 Delivered-To: freebsd-hackers@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 655EA37B404 for ; Mon, 10 Mar 2003 10:59:54 -0800 (PST) Received: from rwcrmhc52.attbi.com (rwcrmhc52.attbi.com [216.148.227.88]) by mx1.FreeBSD.org (Postfix) with ESMTP id 9EA5843FA3 for ; Mon, 10 Mar 2003 10:59:53 -0800 (PST) (envelope-from DougB@freebsd.org) Received: from master.gorean.org (12-234-22-23.client.attbi.com[12.234.22.23]) by rwcrmhc52.attbi.com (rwcrmhc52) with SMTP id <2003031018595305200310qre>; Mon, 10 Mar 2003 18:59:53 +0000 Date: Mon, 10 Mar 2003 10:59:52 -0800 (PST) From: Doug Barton To: dslb@tiscali.dk Cc: hackers@freebsd.org Subject: Re: Insecure PHP installation? In-Reply-To: <3E4A9619000044DD@cpfe2.be.tisc.dk> Message-ID: <20030310105901.L11058@znfgre.tberna.bet> References: <3E4A9619000044DD@cpfe2.be.tisc.dk> Organization: http://www.FreeBSD.org/ X-message-flag: Outlook -- Not just for spreading viruses anymore! MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-hackers@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG On Mon, 10 Mar 2003 dslb@tiscali.dk wrote: > Hi all > > I know PHP is not in the base system, but I thought I could ask here anyway. You should have asked this on freebsd-ports@freebsd,org, and cc'ed the PHP maintainer, FYI. > I have installed PHP on my FreeBSD 4.7 computer and did a "find / -perm > +0002". I could see that /usr/local/bin/pear is a script and world writable, > isn't that a little dangerous? That's definitely bad, yes. Please use send-pr to file a problem report about this. Doug -- This .signature sanitized for your protection To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-hackers" in the body of the message