Slashdot Mirror
Security Hole Found in 4.3.0
Saint Aardvark writes "The good folks at PHP.net have warned of a serious vulnerability in PHP 4.3.0: 'Anyone with access to websites hosted on a web server which employs the CGI module may exploit this vulnerability to gain access to any file readable by the user under which the webserver runs.
A remote attacker could also trick PHP into executing arbitrary PHP code if attacker is able to inject the code into files accessible by the CGI. This could be for example the web server access-logs.' It's recommend that you upgrade to 4.3.1 right away."
Damn, I just installed 2.0.44. I'm so behind the curve!
Apache 4.3.0??? WTF??
oh wait, they're talking about PHP!!
and it looks like the CGI version, NOT the Apache module, correct? Please clarify for the morons in the audience such as myself.
So the 3 guys that actually use PHP as a CGI module can upgrade and the rest of us can go back to jerking off!
One would hope it could make made clear in the title (currently: "Apache: Security Hole Found in 4.3.0") that this is in fact a PHP hole, not an Apache one.
This isn't as much "normalization" as it is "don't take so many drugs when you're designing tables."
Or does it seem like PHP has been afflicted with a lot of vulnerabilities lately?
Maybe the number of news worthy PHP vulnerabilities is a testament to how widely the language is deployed. And, MySQL has had its share, too.
But the Apache and Linux components of "LAMP" seem to have been relatively secure by comparison.
"Provided by the management for your protection."
And just two articles down on the homepage, in the Developers section, there is an article about the dangers of using CGI. How ... ironic?
<mandatory microsft bashing>
Apache can have ALL the features of IIS.
</mandatory microsft bashing>
Remember,democracy never lasts long.It soon wastes, exhausts and murders itself. John Adams (1814)
I could be (and very possibly am) wrong, but doesn't this only affect you if you've installed PHP in your cgi-bin? Otherwise, you can't ignoring .htaccess files by calling PHP directly.
There will always be a local vulnerability where a user could install the PHP binary, but as long as you give users CGI access you are vulnerable to the same kinds of things through a Perl script or a CGI written in C.
Simon
it's just the CGI version... I saw this just before I went to bed, and didn't really feel like upgrading my PHP install.
we now find bugs in versions years before they're ever released, or even planned.... this must have been found by that new government department that monitors everything... would have helped to mention PHP in the title....
My Linux Command of the Day site : LCOD
Anyone know if 4.0.2 or 4.1.2 are affected by this bug? Do those versions have serious security probs of their own?
4.3.0 is crap anyway. I upgraded to it and had nothing but trouble. Most servers I've seen are sticking with 4.2.3
Note! This upgrade is only relevant for those who have enabled the CLI (command line interface) of PHP. Me, Myself and I can at least relax.
Jakob Breivik Grimstveit
"I love deadlines. I love the whooshing noise they make as they go by."
None of my apps use the number 4.3.0, so I'm safe.
Would it be too much to ask to make headlines make a smidgen of sense in the "older articles" section by actually including something like the name of the product affected?
Oh wait, it is.
I've finally had it: until slashdot gets article moderation, I am not coming back.
Class methods are not working as they should in PHP >= 4.3.0; I'd suggest to anyone who does OO in PHP to stay with 4.2.3 as long as they want to keep their scripts working. See for yourself this Bug report
The obvious answer is to patch. I've had to rewrite tiny, but problematic, portions of my PHP code with every upgrade. However, a patch for the same version is a better solution to fixing the security problem. I'll upgrade when I have time and can plan and test properly.