Talking Headers: Part 2 - The HP Security Laboratory Blog -
Talking Headers: Part 2

While my rookie Mark McGwire cards aren't appreciating at all, my header collection is.  Check these actual headers out:

  • php warning: Unknown(): Unable to load dynamic library '/usr/local/lib/php/extensions/no-debug-non-zts-20020429/mysql.so' - Cannot open "/usr/local/lib/php/extensions/no-debug-non-zts-20020429/mysql.so" in Unknown on line 0
  • php: Error parsing /usr/www/users/bob/cgi-bin/php.ini on line 125
  • php warning: Function registration failed - duplicate name - pdf_new in Unknown on line 0, Function registration failed - duplicate name - pdf_delete in Unknown on line 0... [truncated]

Yes, those are actual HTTP header names and values. That's some serious ugliness right there. Why PHP would be reporting errors through the headers I can only guess--but it is.

Finding any information on this via a search engine has proven impossible, as it's polluted with PHP syntax error messages and relevant discussions. So, if you have any ideas as to they why/how of this, I'd be interested to hear them.

And of course, my shameless product plug: WebInspect will alert on these.


Posted 06-03-2009 1:30 PM by Chris Sullo
Filed under: , , ,

Comments

Randy Janinda wrote re: Talking Headers: Part 2
on 06-05-2009 2:35 PM

My guess is that they are normal PHP errors but the developer/admin has turned on output buffering thus the errors simply appear in the header. If output buffering was off, you would probably receive a 501.

Chris Sullo wrote re: Talking Headers: Part 2
on 06-05-2009 5:38 PM

I just tried a bunch of things with output buffering based on your suggestion, but I still can't get errors reported via headers. Great idea, though.

Add a Comment

(required)  
(optional)
(required)  
Remember Me?

Type the numbers and letters above: