Register Globals Fix (security update)

[nexen]

Dear Contributor General Forum:

 

 

I have discovered the register globals vulnerability in oscommerce and I am interested in finding who heads the development for security/vulnerability updates. I would like to contribute the fixes to register globals and would like to either work on the cvs copy or diff against the next milestone.

 

For those of you who don't know what register globals are in php and/or why they make an application potentially vulnerable please read the following paragraph:

 

A registered global is a variable namespace that is used and defined globally. If a global variable of this type is not registered during a get or post or something, a malicious attacker could cause what's known as a "Cross site scripting attack" to occour. This is when a variable is changed through a post or get by inserting malicious code (a jpeg that's actually a binary, or a url to a phishing site, etc).

 

Also this article is the official explination of this vulnerable instance and how to protect one's self against it:

http://www.php.net/manual/en/security.registerglobals.php

 

 

As of version 2.2m2, register globals are still required (however if I remember the other day's work well, then it is benign). There are sporatic explinations on the net, which will help, but no official branch or patch. I notice also the ipn/paypal application is highly dependant on register globals (I spent the other day porting oscommerce).

 

Again, I'd like to request information on who to contact or where the CVS is located or any related urls where register globals fixes are being tracked. I noticed oscommerce has more than a few register globals per php file, and there's no visible (googleable) area where this development takes place.

 

Thanks for those who read this forum and contribute to oscommerce. Please email me directly if you are a maintainer and have knowledge of an effort, if any, to include this in the next release.

 

Sincerely,

NeXeN

[MarcoZorro]

This problem has been addressed in the next release.

 

To get the latest copy of the CVS take a look at

 

http://www.oscommerce.com/community/cvs

[♥Vger]

I would like to contribute the fixes to register globals and would like to either work on the cvs copy or diff against the next milestone.

 

Nice offer, but fixed via Contribution in osCommerce 2.2 MS2 some time ago, and covered by default (as in above post) in the new MS3 when it is released.

 

There are two available contributions for MS2, the original which allows you to install file by file, line by line (useful for sites already modified), or as complete patched files (useful for new installations). The link to the latter is below my name.

 

Vger

Edited July 25, 2005 by Vger