101733 2003-05-17  20:08  /11 rader/ Lorenzo Manuel Hernandez Garcia-Hierro <security@lorenzohgh.com>
Importerad: 2003-05-17  20:08  av Brevbäraren
Extern mottagare: bugtraq@securityfocus.com
Mottagare: Bugtraq (import) <4934>
Ärende: Path Disclosure in Turba of Horde
------------------------------------------------------------



There is a path disclosure in status.php of Turba module at Horde 2.1,
you get this:

Fatal error: Call to a member function on a non-object 
in /opt/local/apache/htdocs/horde/turba/status.php on line 12

NOTE: i observed that this only occur in Turba....
(101733) /Lorenzo Manuel Hernandez Garcia-Hierro <security@lorenzohgh.com>/
Kommentar i text 101740 av Anil Madhavapeddy <anil@recoil.org>
101740 2003-05-17  22:05  /21 rader/ Anil Madhavapeddy <anil@recoil.org>
Importerad: 2003-05-17  22:05  av Brevbäraren
Extern mottagare: Lorenzo Manuel Hernandez Garcia-Hierro <security@lorenzohgh.com>
Mottagare: Bugtraq (import) <4940>
Kommentar till text 101733 av Lorenzo Manuel Hernandez Garcia-Hierro <security@lorenzohgh.com>
Ärende: Re: Path Disclosure in Turba of Horde
------------------------------------------------------------
On Sat, May 17, 2003 at 01:18:59PM -0000, Lorenzo Manuel Hernandez Garcia-Hierro wrote:
> 
> There is a path disclosure in status.php of Turba module at Horde 2.1,
> you get this:
> 
> Fatal error: Call to a member function on a non-object 
> in /opt/local/apache/htdocs/horde/turba/status.php on line 12
> 
> NOTE: i observed that this only occur in Turba....

This is a bit of a silly advisory ... the recommended production
deployment for PHP is to point run-time error logging to a file,
and not the script output.

Have a look at the 'display_errors' and 'log_errors' entries
in your php.ini.  Once you set these appropriately, any PHP errors
(including the above) will be safely stored in a log-file for the
admin to look at.

Anil
(101740) /Anil Madhavapeddy <anil@recoil.org>/------