New PHP Vulnerability:?-s may expose source code for mod

Re: New PHP Vulnerability:?-s may expose source code for mod_cgi

#11

Post by randomdrake » Thu, May 03, 2012, 8:33 PM UTC

1) It's not new.

2) Running PHP as regular CGI (not FCGI) is a very dated practice so the amount of implementations that are vulnerable is probably limited.

Re: New PHP Vulnerability:?-s may expose source code for mod_cgi

#12

Post by reginaldo » Thu, May 03, 2012, 8:35 PM UTC

fusiongyro wrote: post #8

nthitz wrote: post #7

Wow, it's pretty scary that a vulnerability as simple as this has been around for 8 years!

Yeah, but nobody's run PHP in this silly CGI configuration for 10 years.

Yeah, last time I worked with php was 2002 and we were already on mod_php.

Re: New PHP Vulnerability:?-s may expose source code for mod_cgi

#13

Post by bleusink » Thu, May 03, 2012, 8:36 PM UTC

fusiongyro wrote: post #8

nthitz wrote: post #7

Wow, it's pretty scary that a vulnerability as simple as this has been around for 8 years!

Yeah, but nobody's run PHP in this silly CGI configuration for 10 years.

I wouldn't be so sure: http://wiki.dreamhost.com/Php#PHP_on_DreamHost

Re: New PHP Vulnerability:?-s may expose source code for mod_cgi

#14

Post by kevindication » Thu, May 03, 2012, 8:46 PM UTC

ComputerGuru wrote: post #3

This vulnerability is about as bad as it gets, and my heart stopped while I was reading the intro (it's so trivially simple to compromise a site). Then I reached this sentence, which I felt needed to be bolded and underlined: A large number of sites run PHP as either an Apache module through mod_php or using php-fpm under nginx. Neither of these setups are vulnerable to this. . Thank God. That said, some blackhats ar…

Given how long this has been a problem, it would be interesting to look back through access logs to find attempts to use this.

Re: New PHP Vulnerability:?-s may expose source code for mod_cgi

#15

Post by gouranga » Thu, May 03, 2012, 8:47 PM UTC

That's hilariously shitty.

Although to be honest I doubt it's going to affect anyone as I reckon 99%+ are on mod_php.

Re: New PHP Vulnerability:?-s may expose source code for mod_cgi

#16

Post by TazeTSchnitzel » Thu, May 03, 2012, 8:51 PM UTC

Huh. I'd used that method of passing in parameters, mistakenly thinking it was the correct way to get a query string.

Then I asked on SO and found out I was doing things horribly, horribly wrong.

Re: New PHP Vulnerability:?-s may expose source code for mod_cgi

#17

Post by jsnrkd » Thu, May 03, 2012, 9:01 PM UTC

Does anyone have an example site to see this in action?

Re: New PHP Vulnerability:?-s may expose source code for mod_cgi

#18

Post by arondeparon » Thu, May 03, 2012, 9:06 PM UTC

fusiongyro wrote: post #8

nthitz wrote: post #7

Wow, it's pretty scary that a vulnerability as simple as this has been around for 8 years!

Yeah, but nobody's run PHP in this silly CGI configuration for 10 years.

Dutch ISP KPN actually has a hosting service that runs PHP primarily in CGI mode: https://www.google.com/#hl=en&output=search&sclient=... yields a massive amount of vulnerable sites.

Re: New PHP Vulnerability:?-s may expose source code for mod_cgi

#19

Post by maratd » Thu, May 03, 2012, 9:09 PM UTC

bleusink wrote: post #13

fusiongyro wrote: post #8

Earlier quoted context omitted.

Yeah, but nobody's run PHP in this silly CGI configuration for 10 years.

I wouldn't be so sure: http://wiki.dreamhost.com/Php#PHP_on_DreamHost

That's horrible! I would never use a host that relied on CGI for anything. There's a reason they came out with FastCGI.

Re: New PHP Vulnerability:?-s may expose source code for mod_cgi

#20

Post by maratd » Thu, May 03, 2012, 9:12 PM UTC

ComputerGuru wrote: post #3

This vulnerability is about as bad as it gets, and my heart stopped while I was reading the intro (it's so trivially simple to compromise a site). Then I reached this sentence, which I felt needed to be bolded and underlined: A large number of sites run PHP as either an Apache module through mod_php or using php-fpm under nginx. Neither of these setups are vulnerable to this. . Thank God. That said, some blackhats ar…

Additionally:

The vulnerability can only be exploited if the HTTP server follows a fairly obscure part of the CGI spec. Apache does this, but many other servers do not.

From: http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/