Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New PHP Vulnerability:?-s may expose source code for mod_cgi

php.net

Post reply on HN
Print view View original

51–60 of 65 posts

Re: New PHP Vulnerability:?-s may expose source code for mod_cgi

#51

Post by kbolino »

DougBTX wrote: post #33
kbolino wrote: post #29

Earlier quoted context omitted.

What is it wasting? If the process is idle, then it is only taking up space in memory. If that space isn't needed, then the cost is nil (it takes the same amount of power to store a 1 as a 0; the real power cost is in moving data in and out of memory, not in storing it). If the space is needed, then the idle process can be swapped out to disk. So again, no practical cost. FastCGI may not be the best solution, but CGI…

> then the idle process can be swapped out to disk. If the FastCGI process is swapped out, does it still have a performance benefit?

Caveat: As they say, one good test is worth a thousand expert opinions, and I'm no expert.

I'm inclined to say yes, it would still have a benefit. My thoughts:

- Swapping the FastCGI process back in shouldn't be any worse than loading a CGI process cold and initializing it (disk caching will probably be no help to CGI here: with so little free memory, the cache will be small or nonexistent and aggressively purged);

- Once swapped in, the FastCGI process will be able to handle multiple requests in less time and less memory than it would take just to start the many CGI processes necessary to do the same work.

Also, if the performance of your server is an issue, your FastCGI process should never be in a situation where it would be swapped out. You need to add more memory, and/or reduce the other loads on your server.

Re: New PHP Vulnerability:?-s may expose source code for mod_cgi

#52

Post by jsprinkles »

fusiongyro wrote: post #8
nthitz wrote: post #7

Wow, it's pretty scary that a vulnerability as simple as this has been around for 8 years!

Yeah, but nobody's run PHP in this silly CGI configuration for 10 years.

I've already found nine vulnerable sites. Six gave me database passwords in the disclosure, including one at Sony.

Re: New PHP Vulnerability:?-s may expose source code for mod_cgi

#56

Post by kijin »

ecaron wrote: post #23
ComputerGuru wrote: post #3

This vulnerability is about as bad as it gets, and my heart stopped while I was reading the intro (it's so trivially simple to compromise a site). Then I reached this sentence, which I felt needed to be bolded and underlined: A large number of sites run PHP as either an Apache module through mod_php or using php-fpm under nginx. Neither of these setups are vulnerable to this. . Thank God. That said, some blackhats ar…

You're right, my title was a bit sensational. I softened it a bit by appended mod_cgi. I think it is very telling that the PHP core recognizes that the people using mod_cgi probably can't upgrade so they're offering a .htaccess adjustment - very commendable.

Well, after all, PHP is all about backwards compatibility.

Re: New PHP Vulnerability:?-s may expose source code for mod_cgi

#57

Post by marklindhout »

wanderr wrote: post #21

As has been mentioned, using CGI for php is quite outdated so it probably doesn't impact that many sites, that said this sort of vulnerability is exactly why you should put all but the minimum front controller PHP in a folder that's outside of the public folder your site is being served from.

Absolutely not. Lighttpd and Nginx both use it, and have recently picked up a lot of popularity because of it.

It maybe an old mechanism, but it is fast, which is worth something these days :)

Re: New PHP Vulnerability:?-s may expose source code for mod_cgi

#58

Post by EvilTerran »

soc88 wrote: post #44
NaturalDoc wrote: post #2

what? a new php vulnerability? havent heard of one of these for a few hours!!

I don't understand why this is downvoted, considering that the bugfixes don't work.

Perhaps because vacuous, pandering snark adds absolutely no value to the conversation?

Re: New PHP Vulnerability:?-s may expose source code for mod_cgi

#59

Post by gregbair »

marklindhout wrote: post #57
wanderr wrote: post #21

As has been mentioned, using CGI for php is quite outdated so it probably doesn't impact that many sites, that said this sort of vulnerability is exactly why you should put all but the minimum front controller PHP in a folder that's outside of the public folder your site is being served from.

Absolutely not. Lighttpd and Nginx both use it, and have recently picked up a lot of popularity because of it. It maybe an old mechanism, but it is fast, which is worth something these days :)

Those generally use FastCGI, which again, is not vulnerable.

Re: New PHP Vulnerability:?-s may expose source code for mod_cgi

#60

Post by TazeTSchnitzel »

yahelc wrote: post #49
TazeTSchnitzel wrote: post #16

Huh. I'd used that method of passing in parameters, mistakenly thinking it was the correct way to get a query string. Then I asked on SO and found out I was doing things horribly, horribly wrong.

How would that have worked?

    http://example.com/cgi/mything?stuff
Results in apache calling:

    /home/ajf/cgi/mything stuff
Post reply on HN