Slashdot Mirror
Recently Exposed PHP Hole's Official Fix Ineffective
wiredmikey writes "On Wednesday, a remote code execution vulnerability in PHP was accidentally exposed to the Web, prompting fears that it may be used to target vulnerable websites on a massive scale. The bug itself was traced back to 2004, and came to light during a recent CTF competition. 'When PHP is used in a CGI-based setup (such as Apache's mod_cgid), the php-cgi receives a processed query string parameter as command line arguments which allows command-line switches, such as -s, -d or -c to be passed to the php-cgi binary, which can be exploited to disclose source code and obtain arbitrary code execution,' a CERT advisory explains. PHP developers pushed a fix for the flaw, resulting in the release of PHP 5.3.12 and 5.4.2, but as it turns out it didn't actually remove the vulnerability."
PHP is a pile of shit and its authors don't have the slightest concept of what they're doing.
Next up on the news: water is wet.
More at 6.
oh, your company's httpd and its modules are written in a script, and not C? do tell. your web framework language of choice isn't written in C or C++, do tell. Of course YOU DO use C or C++ for web facing wares.