PHP vulnerability

by mamouth • 4 May 2012, 15:36 • Journals
Hi CF !

To everyone who is using php-cgi for server, plz update :

http://www.php.net/archive/2012.php#id2012-05-03-1

we can see your php file source code :D

Quote[03-May-2012]

There is a vulnerability in certain CGI-based setups (Apache+mod_php and nginx+php-fpm are not affected) that has gone unnoticed for at least 8 years. Section 7 of the CGI spec states:
Some systems support a method for supplying a [sic] array of strings to the CGI script. This is only used in the case of an `indexed' query. This is identified by a "GET" or "HEAD" HTTP request with a URL search string not containing any unencoded "=" characters.

So, requests that do not have a "=" in the query string are treated differently from those who do in some CGI implementations. For PHP this means that a request containing ?-s may dump the PHP source code for the page, but a request that has ?-s&=1 is fine.

A large number of sites run PHP as either an Apache module through mod_php or using php-fpm under nginx. Neither of these setups are vulnerable to this. Straight shebang-style CGI also does not appear to be vulnerable.

If you are using Apache mod_cgi to run PHP you may be vulnerable. To see if you are, just add ?-s to the end of any of your URLs. If you see your source code, you are vulnerable. If your site renders normally, you are not.

To fix this, update to PHP 5.3.12 or PHP 5.4.2.
Comments
12
▼
beAsty 4 May 2012, 16:43
every site i tried so far seems to be fixed already :(
▼
mamouth 4 May 2012, 16:46
A large number of sites run PHP as either an Apache module through mod_php or using php-fpm under nginx. Neither of these setups are vulnerable to this. Straight shebang-style CGI also does not appear to be vulnerable.

Most of them don't use mode_cgi
Parent
▼
beAsty 4 May 2012, 16:47
ye true that :P
Parent
▼
Cardo 4 May 2012, 17:57
some do use ecg
Parent
▼
bAnga 4 May 2012, 17:03
Is it oké that I don't care?:$
▼
msh100 4 May 2012, 17:59
Yeh, no one uses this crap anyway xD
Parent
▼
Exc1te 4 May 2012, 18:58
does not affect me, running nginx + php5-fpm! :D

according to tweakers.net the update doesn't fix this issue though :/
▼
qsd 4 May 2012, 18:59
Nikon's website seems vulnerable.
http://support.nikonusa.com/app/?-s
http://support.webroot.com/app/answers/detail/a_id/1761?-s

That update doesn't seem to fix that leak either.
▼
Indloon 4 May 2012, 19:44
Oh noes, PHP.

Who uses it anyways today.

Python on the way!!
▼
skooli 4 May 2012, 20:15
why the hell would anyone be using php-cgi?
▼
mamouth 4 May 2012, 20:56
Don't know, but some people still use it anyway.
Parent
▼
Exc1te 5 May 2012, 00:39
news post on tweakers.net: KPN ( Dutch telecom ) Business hosting vulnerable by this exploit :{D
Parent
Back to top