--==========09E28E9808FD81E7B2D1==========
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

--On June 6, 2006 4:32:02 PM -0400 "Steven M. Christey" <coley@mitre.org>=20
wrote:
>>
>> Yet know we're getting "security advisories" warning, hey, if you
>> change the defaults and ignore all the warnings, you too can write
>> insecure code!
>
> In this sense, I agree. Default configuration is one thing, but
> active negligence is another.
>
> That said, Squirrelmail apparently thinks this issue is important
> enough to release an advisory:
>
> http://www.squirrelmail.org/security/issue/2006-06-01
>
> So maybe they know more about the implications on their consumers than
> we do.
>
Did you look at the patch?

It's almost 40 lines of code designed to *force* register_globals to "off"=20
no matter what the idiot behind the wheel does.

I understand that there are many shared hosting sites that have=20
register_globals set to "on". IMNSHO opinion they are putting their=20
customers at risk unnecessarily. The default setting should be "off", and=20
if someone needs it turned on in the application they're using, they can=20
turn it on there and assume the risk themselves.

It wouldn't take much for web hosting companies to educate their users. A=20
few lines of advice on a webpage would suffice. For example, for Apache=20
users, you can set the php_flag register_globals on/off in a VirtualHost=20
context (inside <Directory>.) So the hosting company can enable it on=20
request but use the proper default setting for most sites.

Or the individual webmasters can set php_register_globals =3D [on|off] in a =

..htaccess file (Apache 1.3.x only!) or php_value register_globals [0|1]=20
(Apache 2.x only!) if they don't like the default setting the hosting=20
company uses. Or they can simply include a file with the setting in it and =

add an include statement to the code of the app.

I'm sure there are other methods that could be used as well. Since there=20
are many options available, the default should be secure.

Paul Schmehl (pauls@utdallas.edu)
Adjunct Information Security Officer
The University of Texas at Dallas
http://www.utdallas.edu/ir/security/

--==========09E28E9808FD81E7B2D1==========
Content-Type: application/pkcs7-signature
Content-Transfer-Encoding: base64

MIIO7AYJKoZIhvcNAQcCoIIO3TCCDtkCAQExCzAJBgUrDgMCGg UAMAsGCSqGSIb3
DQEHAaCCDFowggVzMIIE3KADAgECAhAhQ2wPNrJWs2gXrRmRcA j6MA0GCSqGSIb3
DQEBBAUAMIHqMScwJQYDVQQKEx5UaGUgVW5pdmVyc2l0eSBvZi BUZXhhcyBTeXN0
ZW0xHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsxOz A5BgNVBAsTMlRl
cm1zIG9mIHVzZSBhdCBodHRwczovL3d3dy52ZXJpc2lnbi5jb2 0vcnBhIChjKTk5
MTIwMAYDVQQLEylDbGFzcyAyIENBIC0gT25TaXRlIEluZGl2aW R1YWwgU3Vic2Ny
aWJlcjEtMCsGA1UEAxMkVGhlIFVuaXZlcnNpdHkgb2YgVGV4YX MgYXQgRGFsbGFz
IENBMB4XDTA1MDgxMDAwMDAwMFoXDTA2MDgxMDIzNTk1OVowgf QxJzAlBgNVBAoU
HlRoZSBVbml2ZXJzaXR5IG9mIFRleGFzIFN5c3RlbTEtMCsGA1 UECxQkVGhlIFVu
aXZlcnNpdHkgb2YgVGV4YXMgYXQgRGFsbGFzIENBMUYwRAYDVQ QLEz13d3cudmVy
aXNpZ24uY29tL3JlcG9zaXRvcnkvQ1BTIEluY29ycC4gYnkgUm VmLixMSUFCLkxU
RChjKTk5MRgwFgYDVQQLFA9NYWlsIFN0b3AgLSBVVEQxFTATBg NVBAMTDFBhdWwg
U2NobWVobDEhMB8GCSqGSIb3DQEJARYScGF1bHNAdXRkYWxsYX MuZWR1MIGfMA0G
CSqGSIb3DQEBAQUAA4GNADCBiQKBgQDEoeaWOSJTLA4v6OJEuC fJukxz2ljvM2G7
CovCFsCYK7FnYSzTjFAk8Vhe+STjF4ehWIMnyGzWHYP6Vude2s WSxsXvUANOsjNK
eWZ5rSjFS52u+1JU2IiIiwISnlAmOKC9eqXGq7iIPz35w3Vbpx PeGe6GWK4ZfexT
KSQtfPYfSQIDAQABo4ICDDCCAggwCQYDVR0TBAIwADAdBgNVHR EEFjAUgRJwYXVs
c0B1dGRhbGxhcy5lZHUwggEkBgNVHSAEggEbMIIBFzCCARMGC2 CGSAGG+EUBBwEG
MIIBAjArBggrBgEFBQcCARYfaHR0cHM6Ly93d3cudmVyaXNpZ2 4uY29tL3JwYS1r
cjCB0gYIKwYBBQUHAgIwgcUagcJOT1RJQ0U6IFByaXZhdGUga2 V5IG1heSBiZSBy
ZWNvdmVyZWQgYnkgVmVyaVNpZ24ncyBjdXN0b21lciB3aG8gbW F5IGJlIGFibGUg
dG8gZGVjcnlwdCBtZXNzYWdlcyB5b3Ugc2VuZCB0byBjZXJ0aW ZpY2F0ZSBob2xk
ZXIuICBVc2UgaXMgc3ViamVjdCB0byB0ZXJtcyBhdCBodHRwcz ovL3d3dy52ZXJp
c2lnbi5jb20vcnBhLWtyIChjKTk5LjARBglghkgBhvhCAQEEBA MCB4AwdQYDVR0f
BG4wbDBqoGigZoZkaHR0cDovL29uc2l0ZWNybC52ZXJpc2lnbi 5jb20vVGhlVW5p
dmVyc2l0eW9mVGV4YXNTeXN0ZW1UaGVVbml2ZXJzaXR5b2ZUZX hhc2F0RGFsbGFz
Q0EvTGF0ZXN0Q1JMLmNybDALBgNVHQ8EBAMCB4AwHQYDVR0lBB YwFAYIKwYBBQUH
AwQGCCsGAQUFBwMCMA0GCSqGSIb3DQEBBAUAA4GBAEHYOgkUsy vG/DYGFAKSJ+Iq
UY4NVstEHCKHim3Cckq0Chxf+yRQB4tvOrwPTFAHlMgqJKr4yV XEvwJmhAvJtO/V
nYex/brnBVky3UI288HXzk7439zbvmmczLZmOhsR3A3TnKHX9vdTmJ7 sxWExDszR
QntTfoUYcQihaFVOqZ9sMIID2DCCA0GgAwIBAgIQQewfPacUB5 bE9tUM3dEPZTAN
BgkqhkiG9w0BAQUFADCBwTELMAkGA1UEBhMCVVMxFzAVBgNVBA oTDlZlcmlTaWdu
LCBJbmMuMTwwOgYDVQQLEzNDbGFzcyAyIFB1YmxpYyBQcmltYX J5IENlcnRpZmlj
YXRpb24gQXV0aG9yaXR5IC0gRzIxOjA4BgNVBAsTMShjKSAxOT k4IFZlcmlTaWdu
LCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxHzAdBg NVBAsTFlZlcmlT
aWduIFRydXN0IE5ldHdvcmswHhcNOTkwMzMxMDAwMDAwWhcNMD kwMzMwMjM1OTU5
WjCB6jEnMCUGA1UEChMeVGhlIFVuaXZlcnNpdHkgb2YgVGV4YX MgU3lzdGVtMR8w
HQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTswOQYDVQ QLEzJUZXJtcyBv
ZiB1c2UgYXQgaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL3JwYS AoYyk5OTEyMDAG
A1UECxMpQ2xhc3MgMiBDQSAtIE9uU2l0ZSBJbmRpdmlkdWFsIF N1YnNjcmliZXIx
LTArBgNVBAMTJFRoZSBVbml2ZXJzaXR5IG9mIFRleGFzIGF0IE RhbGxhcyBDQTCB
nzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAv+rvh+seCsEA+S IRwdHBzNt62r42
0nBgMGDlGeBTLzX0yagpBdbePZ3zBppkfb7Rh1R4m/+iePH7h6vD/IdMwklBDeHA
0qXX/H7/QlFOdPMB1WhzpV0EMfjmKSVjqCOaRGqBiw+wOfHv20ZYw7q4z0 vzesGi
SZWDI0O6mxqPMoUCAwEAAaOBpTCBojApBgNVHREEIjAgpB4wHD EaMBgGA1UEAxMR
UHJpdmF0ZUxhYmVsMS0xNDAwEQYJYIZIAYb4QgEBBAQDAgEGME QGA1UdIAQ9MDsw
OQYLYIZIAYb4RQEHAQEwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly 93d3cudmVyaXNp
Z24uY29tL1JQQTAPBgNVHRMECDAGAQH/AgEAMAsGA1UdDwQEAwIBBjANBgkqhkiG
9w0BAQUFAAOBgQBTCbXcsraJ0SBQg8k4edzICLJJv7hTg2+KzL Lkenz8o+gPX2Fe
X5cElRJa0pUBIvG87fFUtlSmVBihnVS8BmkExwIhN6KCOYinrK Cf6IMZXZJIORpZ
giQgQ7yGlRLcg3Th5uMTvmqkhwAxMSMHJZuvuixRkQ5ZpqMXiN K0zlQXHDCCAwMw
ggJsAhEAuS9gzIifoXpGCbhbcGyKrzANBgkqhkiG9w0BAQUFAD CBwTELMAkGA1UE
BhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMTwwOgYDVQ QLEzNDbGFzcyAy
IFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaX R5IC0gRzIxOjA4
BgNVBAsTMShjKSAxOTk4IFZlcmlTaWduLCBJbmMuIC0gRm9yIG F1dGhvcml6ZWQg
dXNlIG9ubHkxHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldH dvcmswHhcNOTgw
NTE4MDAwMDAwWhcNMjgwODAxMjM1OTU5WjCBwTELMAkGA1UEBh MCVVMxFzAVBgNV
BAoTDlZlcmlTaWduLCBJbmMuMTwwOgYDVQQLEzNDbGFzcyAyIF B1YmxpYyBQcmlt
YXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IC0gRzIxOjA4Bg NVBAsTMShjKSAx
OTk4IFZlcmlTaWduLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdX NlIG9ubHkxHzAd
BgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmswgZ8wDQYJKo ZIhvcNAQEBBQAD
gY0AMIGJAoGBAKeIASF0LOcaA/CY4Zc8DyEI8Zzbl+ma/MIEBhO+X1LIzB4sElYs
uAFpLMyZH62wlq55BPITOcF7mLoILOjChBMsqmnpCfTHqQKkQs IjT0rY8A6i+zFs
yeZvmScH9eb0THiebetGhvq5hslU8rLEr9RGHFrJFTD/DWz1LQ5tzn93AgMBAAEw
DQYJKoZIhvcNAQEFBQADgYEAci75f9HxcfvEnvbFXlGKQJi4aP ibHIPY4p29/+2h
5mbqLwn0ytfqpSuV9iRghk1ELoOlxC2g0654aW9y2myuCPBjkj fmu8QwF613zEk1
qs/Yj9G+txiWR3NqVCI0ZC22FptZW7RRWTqzCxT0Et9noPStMmRes UZyJ4wSe8VE
tK4xggJaMIICVgIBATCB/zCB6jEnMCUGA1UEChMeVGhlIFVuaXZlcnNpdHkgb2Yg
VGV4YXMgU3lzdGVtMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdC BOZXR3b3JrMTsw
OQYDVQQLEzJUZXJtcyBvZiB1c2UgYXQgaHR0cHM6Ly93d3cudm VyaXNpZ24uY29t
L3JwYSAoYyk5OTEyMDAGA1UECxMpQ2xhc3MgMiBDQSAtIE9uU2 l0ZSBJbmRpdmlk
dWFsIFN1YnNjcmliZXIxLTArBgNVBAMTJFRoZSBVbml2ZXJzaX R5IG9mIFRleGFz
IGF0IERhbGxhcyBDQQIQIUNsDzayVrNoF60ZkXAI+jAJBgUrDg MCGgUAoIGxMBgG
CSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ 8XDTA2MDYwNzAx
MDUxOFowIwYJKoZIhvcNAQkEMRYEFHHgh5GjRNdh84366RtyW+ 9mvRtOMFIGCSqG
SIb3DQEJDzFFMEMwCgYIKoZIhvcNAwcwDgYIKoZIhvcNAwICAg CAMA0GCCqGSIb3
DQMCAgFAMAcGBSsOAwIHMA0GCCqGSIb3DQMCAgEoMA0GCSqGSI b3DQEBAQUABIGA
mQUoQwpl+MA91fJ/27Sd2VPLRChCQjY5fl8bXSdiIcRgfZ+1hE70HMC+zrF7eskj
cieYK51xOhDX7kOE45llu6OwFLCLOyAbccLLqQoPdgSMdbTdOb Wt5fCl7HNp4Yc1
tLamf1qLCDEJYpm8W81ZQzMwLp3ZGPowI4bk0zH/Buo=

--==========09E28E9808FD81E7B2D1==========--