Preserved Topic: PHP (3.x & 4.X) remote fileupload vulnerabilities...

Details: http://security.e-matters.de/advisories/012002.html
PHP 4.1.2: http://www.php.net/downloads.php

damn my bad english, what's arbitrary code?

Kinda hard to explain but it basically (in this context) means not well thought out or used for convenience as opposed to real functionality. Essentially not well planned and thought about.


This also goes back to the post-upload vs. ftp upload discussed in this thread.



:[ Computers let you make more mistakes faster than any other invention in human history, with the possible exceptions of handguns and tequila. ]:

[This message has been edited by bitdamaged (edited 02-28-2002).]

hmmmm.....
could you give an example?

Actually I would say bitdamaged's explanation is actually more about arbitrary in OTHER contexts. In this context it just means they can run any code they want.

Generally he's right though, arbitrary usually means choosing something without much consideration or reason for consideration. Such as:

"For a simple database of phone numbers you could use either mSQL or mySQL, the choice is arbitrary."

"I didn't care where I went, so I just arbitrarily chose a restaurant."

-jiblet

Grumble, your english is good, but this word has many meanings in different contexts.

arbitrary code<- comes same as for the IIS flows->when the buffer overflows and the overflowed bytes are real Opcodes that get ran on the victim's stack segment (mostly).