PHP patch quick but inadequate

by Carol~ Moderator - 5/4/12 8:45 AM

In Reply to: NEWS - May 04, 2012 by Carol~ Moderator

The updates to PHP versions 5.3.12 and 5.4.2 released on Thursday do not fully resolve the vulnerability that was accidentally disclosed on Reddit, according to the discoverer of the flaw. The bug in the way CGI and PHP interact with each other leads to a situation where attackers can execute code on affected servers. The issue remained undiscovered for eight years.

The best protection at present is offered by setting up filter rules on the web server. However, the RewriteRule workaround described on PHP.net is also, according to security expert Christopher Kunz, inadequate. He suggests a slightly modified form of the rule as an alternative.

Because the PHP interpreter for CGI does not comply with the specifications laid out in the CGI standard, URL parameters can, under certain circumstances, be passed to PHP as command line arguments. Servers which run PHP in CGI mode are affected; FastCGI PHP installations are not...

Continued : http://www.h-online.com/security/news/item/PHP-patch-quick-but-inadequate-1568454.html

Related: Serious Remote PHP Bug Accidentally Disclosed

See Vulnerabilities & Fixes: PHP PHP-CGI QUERY_STRING Parameter Vulnerability