New PHP Vulnerability:?-s may expose source code for mod

New PHP Vulnerability:?-s may expose source code for mod_cgi

#1

Post by ecaron » Thu, May 03, 2012, 7:55 PM UTC

New PHP Vulnerability:?-s may expose source code for mod_cgi
php.net

Re: New PHP Vulnerability:?-s may expose source code for mod_cgi

#2

Post by NaturalDoc » Thu, May 03, 2012, 8:07 PM UTC

what? a new php vulnerability? havent heard of one of these for a few hours!!

Re: New PHP Vulnerability:?-s may expose source code for mod_cgi

#3

Post by ComputerGuru » Thu, May 03, 2012, 8:13 PM UTC

This vulnerability is about as bad as it gets, and my heart stopped while I was reading the intro (it's so trivially simple to compromise a site).

Then I reached this sentence, which I felt needed to be bolded and underlined:

A large number of sites run PHP as either an Apache module through mod_php or using php-fpm under nginx. Neither of these setups are vulnerable to this.

. Thank God.

That said, some blackhats are going to be really sore that a backdoor that's been wide open for "at least 8 years" is finally being closed.

Re: New PHP Vulnerability:?-s may expose source code for mod_cgi

#4

Post by thaumaturgy » Thu, May 03, 2012, 8:21 PM UTC

ComputerGuru wrote: post #3

This vulnerability is about as bad as it gets, and my heart stopped while I was reading the intro (it's so trivially simple to compromise a site). Then I reached this sentence, which I felt needed to be bolded and underlined: A large number of sites run PHP as either an Apache module through mod_php or using php-fpm under nginx. Neither of these setups are vulnerable to this. . Thank God. That said, some blackhats ar…

It also does not appear to be a problem on servers running php via libapache2-mod-fcgid.

Re: New PHP Vulnerability:?-s may expose source code for mod_cgi

#5

Post by Palomides » Thu, May 03, 2012, 8:22 PM UTC

http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/ has some more info, including the fact that they first reported it to the PHP devs in the middle of January.

Re: New PHP Vulnerability:?-s may expose source code for mod_cgi

#6

Post by ComputerGuru » Thu, May 03, 2012, 8:23 PM UTC

thaumaturgy wrote: post #4

ComputerGuru wrote: post #3

This vulnerability is about as bad as it gets, and my heart stopped while I was reading the intro (it's so trivially simple to compromise a site). Then I reached this sentence, which I felt needed to be bolded and underlined: A large number of sites run PHP as either an Apache module through mod_php or using php-fpm under nginx. Neither of these setups are vulnerable to this. . Thank God. That said, some blackhats ar…

It also does not appear to be a problem on servers running php via libapache2-mod-fcgid.

It basically only affects PHP as CGI (one PHP CGI process is started and stopped for each request). Anything using an alternative communication channel or API to process requests between frontend and backend is safe (for now).

Re: New PHP Vulnerability:?-s may expose source code for mod_cgi

#7

Post by nthitz » Thu, May 03, 2012, 8:23 PM UTC

Wow, it's pretty scary that a vulnerability as simple as this has been around for 8 years!

Re: New PHP Vulnerability:?-s may expose source code for mod_cgi

#8

Post by fusiongyro » Thu, May 03, 2012, 8:29 PM UTC

nthitz wrote: post #7

Wow, it's pretty scary that a vulnerability as simple as this has been around for 8 years!

Yeah, but nobody's run PHP in this silly CGI configuration for 10 years.

Re: New PHP Vulnerability:?-s may expose source code for mod_cgi

#9

Post by vog » Thu, May 03, 2012, 8:31 PM UTC

From the article:

> [...] we had a bug in our bug system [...] causing this issue to go public before we had time to test solutions to the level we would like.

Ouch.

Re: New PHP Vulnerability:?-s may expose source code for mod_cgi

#10

Post by richbradshaw » Thu, May 03, 2012, 8:32 PM UTC

8 years!!!! I wonder how many people knew about this already...

On the other hand, this does make me feel better about my own code!