Slashdot Mirror
PHP Vulnerability Announced
corz writes "Just when you thought you were finished upgrading the webserver, 'The PHP Group has learned of a serious security vulnerability in PHP versions 4.2.0 and 4.2.1. An intruder may be able to execute arbitrary code with the privileges of the web server. This vulnerability may be exploited to compromise the web server and, under certain conditions, to gain privileged access.' Here's the bugtraq announcement." The hole is in the parsing of HTTP POST headers and can allow arbitrary code to be run on vulnerable machines. PHP thoughtfully decided to release a new version, 4.2.2, today with the fix. You can find a copy of it here (mirror).
Notice how quickly a patch appeared for this. If this were a Windblowz product, the script kiddies would be having a field day while Micro$hit denied the hole existed.
This is what free software is all about. I personally am not affected, as I prefer Perl to PHP, and my personal server is still down until I can figure out how to patch that Apache hole from a few weeks ago, but I am swollen with pride for my fellow Linux hackers.
Karma: Good (despite my invention of the Karma: sig)
Parse error: parse error, unexpected T_SL in /local/Web/sites/phpweb/downloads.php on line 81
;)
Huh??! Bad karma
They say the only difference between 4.2.1 and 4.2.2 is this fix, so it won't (or shouldn't anyway) break any of your scripts.
I'm glad that Open Source programmers have taken up the call, and started to finally deliver high quality, unbreakable products. Imagine! The PHP group has a fix out on exactly the same day the bug is released. It's amazing!
What a fabulous troll your post was.... or how fabulously stupid you are. It's impossible to tell.
I'm not sure how long it took, but the freebsd ports have already been updated.
Since the admins over at NYI.net showed me the light, I have been installing FreeBSD on every machine I can get my hands on, even if they are'nt mine.
Download directly from here. Change the server name to a mirror closer to you if you want.
z 2t ar.gz
http://uk.php.net/distributions/php-4.2.2.tar.b
or
http://uk.php.net/distributions/php-4.2.2.
but... I have mirrored the PHP 4.2.2 tar/bz2 ball on my server (over DSL)... you can access it via FTP at closedsrc.org with anon/anon, or the link below:
ftp://anon:anon@closedsrc.org/.
The md5sum file is based on the md5 checksum provided by the FreeBSD port distinfo file.
I know I'm asking for it...
This is one of the most-installed Apache modules. If this was an IIS exploit you know it'd be on the front page. I don't really mind biased comments in the stories as much, but to actually HIDE news because it goes against the notion that Open Source is invincible is really pathetic.
If I read the bugtraq announcement correctly, on IA32 (including, I assume, my K6-2 Linux Box hosting the webserver) is "safe" from remote code execution (but the server can still be crashed by the exploit). Did I read that right?...
Hacker Public Radio is our Friend
Do you even lift?
These aren't the 'roids you're looking for.
once again, notice the "may" and the "certain circumstances": This vulnerability may be exploited to compromise the web server and, under certain conditions, to gain privileged access. time and time again, i see this in bug announcements, they always throw out the worse possibility, when in fact the majority of people wont be harmed anymore than a blind man tryin to swat a fly.
"you sonofabitch i didn't know!"
newbie here. the file only came with *.patch file and no instructions
A patch is publicly accessible via my webserver here (http://www.initialized.org/patches/php4.2.2-apac
To install the patch on a Unix machine and install PHP using apxs:
(r) designates commands that must be executed as the superuser (root).
- Download the tarball. I recommend using us2.php.net, Hurricane Electric's mirror.
- Execute 'tar xvfz php-4.2.2.tar.gz' from a shell.
- Execute 'cd php-4.2.2'.
- Execute 'wget http://www.initialized.org/patches/php4.2.2-apach
e 2.0.39.diff'. - Execute 'patch sapi/apache2filter/php_functions.c php4.2.2-apache2.0.39.diff'. This command will apply the patch.
- Execute './configure --with-apxs2'. You may specify further options (such as --with-mysql if your applications require MySQL support) following "--with-apxs2".
- (r) Execute 'make'.
- (r) Execute 'make install'.
- (r) Restart Apache. 'apachectl restart' is the most common method of doing so.
If you have any questions or encounter difficulties, feel free to email me.-- Scoria
Do you like German cars?
While the mirror is a good idea, most folks aren't going to download from an unofficial/untrusted source - so you probably won't get hit with too many downloads. Thanks for the kind gesture, though! :)
I can understand a certain amount of vulnerability after 420...
I feel fantastic, and I'm still alive.
According to the announcements the only thing the vulnerability can do is cause your webserver to crash.
Boffoonery - downloadable Comedy Benefit for Bletchley Park
Anyone with anything intelligent to add to this discussion is either busy patching or cracking
NOT posting
If voting were effective, it would be illegal by now.
Things like this happens every day, and what makes me feel good is that I don't have to keep up with Bugtraq and other sources to find out when my business is affected. Instead I receive personalized e-mail alerts.
The service: http://securitywarnings.com/info
Debian users only upgrade the bits they really need to be current, and shake their heads sadly at the Redhat and Mandrake users downloading or buying the exploit of the month.
I just installed PHP on a Apache server that's running on a 2 liter of Coke. d00d, it rox!
They are all at -1
The trolls are winning Taco
End of discussion!!!
I upgraded to 4.2.2 in the middle of developing a site for a client (I know - big "No No") and it was TOTAL BADNESS My login procedure and several sections fo the site just stopped working. Apparently 4.2.2 configures the system such that redirects do not work the same. Needless to say this turned my dev server upsidedown in a mad rain of chaos. Had to do a rollback and just forget about it for now. Once the site works I'll reinstall and debug. caveat emptor.
geeks are cats who dig a certain kind of cool
It's not the same sort of exploit as most IIS exploits. A IIS exploit gives someone access over an entire server. This exploit gives access to a shell which could read Apache-readable files and execute programs. It might even be able to write to /tmp. But no important files can be deleted or written to.