Re: [PHP] Interesting article about PHP security exploit by GIF files

2007-06-21 Thread tedd
At 9:27 PM +0200 6/20/07, Tijnema wrote: On 6/20/07, tedd <[EMAIL PROTECTED]> wrote: If you are worried about evil code being in the image, you could always resample the image (larger or smaller). Not that I have personal experience, but I would think that any piece of code that is resampled is

Re: [PHP] Interesting article about PHP security exploit by GIF files

2007-06-20 Thread Robert Cummings
On Wed, 2007-06-20 at 15:12 -0400, Daniel Brown wrote: > On 6/20/07, tedd <[EMAIL PROTECTED]> wrote: > > At 12:53 PM -0400 6/20/07, Daniel Brown wrote: > > > > > >No, not the upload and execution, per se, but rather using images > > >to contain processable PHP code. > > > > > >-- > > >Daniel P.

Re: [PHP] Interesting article about PHP security exploit by GIF files

2007-06-20 Thread Tijnema
On 6/20/07, tedd <[EMAIL PROTECTED]> wrote: At 2:32 PM -0400 6/20/07, Guillaume Theoret wrote: >Thanks for the link. > >I got worried for a second that my code could be exploited so I did a >quick check to make sure that mime-types were correct. (I check the >mime type to make sure it's an image,

Re: [PHP] Interesting article about PHP security exploit by GIF files

2007-06-20 Thread tedd
At 2:32 PM -0400 6/20/07, Guillaume Theoret wrote: Thanks for the link. I got worried for a second that my code could be exploited so I did a quick check to make sure that mime-types were correct. (I check the mime type to make sure it's an image, not the file extension.) I renamed a .jpg file .

Re: [PHP] Interesting article about PHP security exploit by GIF files

2007-06-20 Thread Daniel Brown
On 6/20/07, tedd <[EMAIL PROTECTED]> wrote: At 12:53 PM -0400 6/20/07, Daniel Brown wrote: > >No, not the upload and execution, per se, but rather using images >to contain processable PHP code. > >-- >Daniel P. Brown Daniel: Wow! Now that's something I would like to see -- you do have a de

Re: [PHP] Interesting article about PHP security exploit by GIF files

2007-06-20 Thread tedd
At 12:53 PM -0400 6/20/07, Daniel Brown wrote: No, not the upload and execution, per se, but rather using images to contain processable PHP code. -- Daniel P. Brown Daniel: Wow! Now that's something I would like to see -- you do have a demo? As far as "legitimate reasons", how about ima

Re: [PHP] Interesting article about PHP security exploit by GIF files

2007-06-20 Thread Guillaume Theoret
Thanks for the link. I got worried for a second that my code could be exploited so I did a quick check to make sure that mime-types were correct. (I check the mime type to make sure it's an image, not the file extension.) I renamed a .jpg file .jpg.php and uploaded it and got application/x-php as

Re: [PHP] Interesting article about PHP security exploit by GIF files

2007-06-20 Thread Daniel Brown
On 6/20/07, Jochem Maas <[EMAIL PROTECTED]> wrote: Daniel Brown wrote: > On 6/20/07, Tijnema <[EMAIL PROTECTED]> wrote: >> Hi all, >> >> Just received a mail from phpclasses, which pointed to this very >> interesting article[1]. Seems good to know for starters ;) >> The experts around here probab

Re: [PHP] Interesting article about PHP security exploit by GIF files

2007-06-20 Thread Jochem Maas
Daniel Brown wrote: > On 6/20/07, Tijnema <[EMAIL PROTECTED]> wrote: >> Hi all, >> >> Just received a mail from phpclasses, which pointed to this very >> interesting article[1]. Seems good to know for starters ;) >> The experts around here probably already know this way of exploits. >> >> Tijnema >

Re: [PHP] Interesting article about PHP security exploit by GIF files

2007-06-20 Thread Daniel Brown
On 6/20/07, Tijnema <[EMAIL PROTECTED]> wrote: Hi all, Just received a mail from phpclasses, which pointed to this very interesting article[1]. Seems good to know for starters ;) The experts around here probably already know this way of exploits. Tijnema [1] http://www.phpclasses.org/blog/pos