PHP Security & Exploit 28
Anonymous Coward writes "It looks like after a few weeks of rumors,
an
exploit for PHP/Apache under Linux surfaced. Luckily, PHP.net has the patch ready to go. While the export only claims to work for PHP up to 4.0.5, php.net also releases a patch for 4.1.1, the (until yesterday), latest version of php. This patch makes a small edition to the part of the source code (rfc1867.c) that is used by the exploit."
Re:"edition"? (Score:1)
looks like the php grammar/spell checker was buggy too!
If you only speak PHP... (Score:2, Funny)
if ($system != 'patched') {
$file_uploads = 'Danger, Will Robinson!';
}
?>
all versions previous to 4.1.2 are at risk (Score:3, Informative)
http://www.php.net/
http://security.e-matters.
The bug report is here:
http://bugs.php.net/bug.php?id=15736
it recomends turning off file uploads as a work around
Why isn't this on the main page? (Score:1)
http://uptime.netcraft.com/up/graph/?mode_u=off&m
The site slashdot.org is running Apache/1.3.20 (Unix) mod_perl/1.25 mod_gzip/1.3.19.1a on Linux.
How to patch major distro versions (Score:2, Interesting)
So my question is: Is there a way to patch the major distro versions (i.e. rh, suse, mandrake
Because if there isn't then there are still gonna be alot of webservers out there running insecure versions of php. And, if there isn't a way, then why isn't there?
Re:How to patch major distro versions (Score:2)
And also, you should check redhats errata page regularly for security updates.
Re:How to patch major distro versions (Score:1)
Re:How to patch major distro versions (Score:2)
Is there a way to patch the major distro versions (i.e. rh, suse, mandrake ...) from there default versions to the secure version?
# apt-get update
# apt-get upgrade
:-)
Re:How to patch major distro versions (Score:1)
The important facts (Score:2, Informative)
However, one line in the config should according to php.net disable the vulnerability
file_uploads = off
(When tested phpinfo(); gives "no value" at my site)
One file needs to be patched for all PHP versions, get the patch here
php.net/downloads.php [php.net]
Patch like this:
1. Enter
2. patch < pathtodiffile/rfc1867.c.diff-4.0.6
3. build either the DSO module or build apache with static php
The "full" advisory is here
security.e-matters.de [e-matters.de]
now, PATCH!
Re:How? (Score:1)
Re:another codered/nimda-like incident in the maki (Score:1)
Also, mod_php isn't installed on millions of peoples computers who have no idea what a web server is like IIS was.
The closest to code red this could do, is pull out all domains, and check for index.php in the root directory. Or maybe it could attempt to index a domain and try to find an index.php...
But as I said.. unless there is a
Re: php runs as "nobody" (Score:1)
And it's not a piece of cake attack either like Red Code II. Some versions are very difficult to exploit.
With RedCode II you could just wipe everything from the HD, steal passwords, certificates, everthing (at least that I thought)
Mirrors (Score:1)
US1 [php.net]
US2 [php.net]
US3 [php.net]
US4 [php.net]
UK1 [php.net]
UK2 [php.net]
IIS5? (Score:1)
Re:IIS5? (Score:1)
From the advisory:
It would seem to be a question of operating system rather than web server.front page news... (Score:1)