[Sheflug] PHP and Plusnet

[Ashe <ashe [at] xxxxxxxxxxxxxxxxxxxxx>]

I found out something interesting about the cgi webspace servers that plusnet 
uses to allow its customers to have php access. It seems that the way it's 
configured means that all users on the system are in the same group, the 
upshot of this is that its perfectly possible to go into another users 
webspace, and grab any sql server password/other interesting hidden goodies. 
Now, maybe I'm naive, and they quite possibly have good reasons to set it up 
the way it is, but I think thats a dreadful bit of system configuration.

Any ideas why they'd pull a stunt like that? Anybody heard of any other ISP's 
using a similar setup?

Ashe
-- 
Never give a sucker an even break, especially if he's a big, mean sucker

___________________________________________________________________

Sheffield Linux User's Group -
http://www.sheflug.co.uk/mailfaq.html

  GNU the choice of a complete generation.