Slashdot Mirror

← Back to Stories (view on slashdot.org)

PHP Security & Exploit

Posted by Hemos on from the fixing-it dept.

Anonymous Coward writes "It looks like after a few weeks of rumors, an exploit for PHP/Apache under Linux surfaced. Luckily, PHP.net has the patch ready to go. While the export only claims to work for PHP up to 4.0.5, php.net also releases a patch for 4.1.1, the (until yesterday), latest version of php. This patch makes a small edition to the part of the source code (rfc1867.c) that is used by the exploit."

2 of 28 comments (clear)

  1. all versions previous to 4.1.2 are at risk by chrismcc@netus.com · · Score: 3, Informative

    All versions previous to 4.1.2 (today's release) are at risk

    http://www.php.net/
    http://security.e-matters.d e/advisories/012002.htm l

    The bug report is here:
    http://bugs.php.net/bug.php?id=15736

    it recomends turning off file uploads as a work around

    --
    Christopher McCrory "The guy that keeps the servers running" chrismcc@gmail.com http://www.pricegrabber.com
  2. The important facts by Anonymous Coward · · Score: 2, Informative

    This is a very high impact vulnerability, mod_php is the worlds most popular Apache module, maybe the most popular web script language. (no flamewars intended, it IS popular among a lot of people whether you like it or not).

    However, one line in the config should according to php.net disable the vulnerability :

    file_uploads = off

    (When tested phpinfo(); gives "no value" at my site)

    One file needs to be patched for all PHP versions, get the patch here :

    php.net/downloads.php

    Patch like this:

    1. Enter ../src/php-4.0.x/main dir
    2. patch < pathtodiffile/rfc1867.c.diff-4.0.6
    3. build either the DSO module or build apache with static php

    The "full" advisory is here :

    security.e-matters.de

    now, PATCH!