Slashdot Mirror

← Back to Stories (view on slashdot.org)

PHP Vulnerability Announced

Posted by krow on from the who-would-have-thunk-it dept.

corz writes "Just when you thought you were finished upgrading the webserver, 'The PHP Group has learned of a serious security vulnerability in PHP versions 4.2.0 and 4.2.1. An intruder may be able to execute arbitrary code with the privileges of the web server. This vulnerability may be exploited to compromise the web server and, under certain conditions, to gain privileged access.' Here's the bugtraq announcement." The hole is in the parsing of HTTP POST headers and can allow arbitrary code to be run on vulnerable machines. PHP thoughtfully decided to release a new version, 4.2.2, today with the fix. You can find a copy of it here (mirror).

12 of 47 comments (clear)

  1. www.php.net/downloads.php by mnordstr · · Score: 3, Funny

    Parse error: parse error, unexpected T_SL in /local/Web/sites/phpweb/downloads.php on line 81

    Huh??! Bad karma ;)

    1. Re:www.php.net/downloads.php by Henry+V+.009 · · Score: 3, Informative

      I went to upgrade php and got that as well. It's the same for the mirrors. This doesn't bode well.

  2. Where to get the file by Anonymous Coward · · Score: 2, Informative

    Download directly from here. Change the server name to a mirror closer to you if you want.

    http://uk.php.net/distributions/php-4.2.2.tar.bz 2
    or
    http://uk.php.net/distributions/php-4.2.2.t ar.gz

  3. Something tells me I shouldn't be doing this by questionlp · · Score: 2

    but... I have mirrored the PHP 4.2.2 tar/bz2 ball on my server (over DSL)... you can access it via FTP at closedsrc.org with anon/anon, or the link below:

    ftp://anon:anon@closedsrc.org/.

    The md5sum file is based on the md5 checksum provided by the FreeBSD port distinfo file.

    I know I'm asking for it...

  4. IA32 "safe" from this? by Dr.Dubious+DDQ · · Score: 3, Interesting

    If I read the bugtraq announcement correctly, on IA32 (including, I assume, my K6-2 Linux Box hosting the webserver) is "safe" from remote code execution (but the server can still be crashed by the exploit). Did I read that right?...

    --
    Hacker Public Radio is our Friend
  5. Re:Apache 2.0.39 incompatibility by Scoria · · Score: 2

    I incorrectly assigned the "superuser" label to the command 'make'. You may execute the 'make' command either as root or a normal user.

    'make install', however, must be performed as root.

    --
    Do you like German cars?
  6. 420 makes you vulnerable! by Thing+1 · · Score: 3, Funny
    The PHP Group has learned of a serious security vulnerability in PHP versions 4.2.0 and 4.2.1.

    I can understand a certain amount of vulnerability after 420...

    --
    I feel fantastic, and I'm still alive.
  7. X86 Linux? by Chuck+Chunder · · Score: 3, Funny

    According to the announcements the only thing the vulnerability can do is cause your webserver to crash.

    --
    Boffoonery - downloadable Comedy Benefit for Bletchley Park
  8. Re:Why is this not front-page? by quinto2000 · · Score: 3, Interesting

    Here's one reason:

    Impact

    Both local and remote users may exploit this vulnerability to compromise
    the web server and, under certain conditions, to gain privileged access.
    So far only the IA32 platform has been verified to be safe from the
    execution of arbitrary code. The vulnerability can still be used on IA32
    to crash PHP and, in most cases, the web server.

    This isn't really a problem on the most widely used platforms for PHP. I was looking to see if the new Debian package had been uploaded yet, but now I'm not even going to bother. I don't care if someone "may" crash the webserver that much.

    --
    Ceci n'est pas un post
  9. Re:Apache 2.0.39 incompatibility by chregu · · Score: 2, Informative

    It's a security bug fix release. Only this bug was fixed to get it out as soon as possible. PHP 4.2.3 will have more bugs fixed (+ a proper QA) and should be released in the next weeks.

    chregu

  10. Re:*sigh* by dzym · · Score: 3, Informative
    But then again, the good folks at Apache didn't think the chunked encoding vulnerability could be used to execute arbitrary code on 32-bit platforms.

    Gobbles proved them wrong.

  11. Re:Shouldn't be a problem by JCCyC · · Score: 2

    While the mirror is a good idea, most folks aren't going to download from an unofficial/untrusted source

    Not necessarily. Get the MD5 sum from the official site, then the tarball from the unofficial site. If it bunzips like a duck and md5sums like a duck...