Tuesday, December 28, 2004

New Santy variant

The <A HREF="http://story.news.yahoo.com/news?tmpl=story&cid=1093&e=3&u=/pcworld/119051">latest version of the Santy worm</A> poses an elevated risk to many Web sites built using the PHP scripting language. Early versions of the Santy worm exploited a specific bug in a bulletin-board software package called phpBB, and their attacks could be prevented by applying a patch to the software. However, the security flaw exploited by newer versions of the worm such as Santy.C or Santy.E is more general, and can occur anywhere a site designer has left the door open for the inclusion of arbitrary files into PHP scripts.

News Timeline



From Our Sponsor