Feeds

PHP devs lob second patch at super-critical CGI bug

If at first you don't succeed, compile, compile again

Top 5 reasons to deploy VMware with Tegile

The developers of PHP have released updates to thwart fresh attacks against systems that use the scripting language to dynamically generate web pages.

All users are encouraged to upgrade to PHP 5.4.3 or PHP 5.3.13, as appropriate, after a serious security bug in PHP-CGI-based setups was disclosed. Developers attempted to fix this long-standing, but only recently discovered, flaw in a new version on 3 May, before deciding the fix was incomplete and releasing a new set of patches on Tuesday, 8 May.

This is just as well because the PHP-CGI vulnerability has become the target of a series of attacks against sites hosted by DreamHost and others over recent days. Attempts to exploit the bug were witnessed by net honeypots maintained by security researchers at TrustWave SpiderLabs. The assaults were ultimately designed to plant backdoors on vulnerable web servers, as an advisory by TrustWave explains.

The PHP-CGI remote code execution bug was discovered by security researchers, who traced the flaw to changes introduced in the codebase way back in 2004. The Eindbazen crew told PHP developers about the bug, and work was going on behind the scenes to develop a fix. However the wheels fell off this project after discussions surrounding the security hole were accidentally made public, exposing the existence of the flaw to world+dog before a patch was ready.

This, in turn, prompted the decision to rush out updates that failed to close the hole before this week's release of a second set of security updates.

PHP 5.4.3 also addresses a buffer overflow vulnerability in the apache_request_headers, as explained in an advisory here. ®

Intelligent flash storage arrays

More from The Register

next story
Knock Knock tool makes a joke of Mac AV
Yes, we know Macs 'don't get viruses', but when they do this code'll spot 'em
Shellshock over SMTP attacks mean you can now ignore your email
'But boss, the Internet Storm Centre says it's dangerous for me to reply to you'
Why weasel words might not work for Whisper
CEO suspends editor but privacy questions remain
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
China is ALREADY spying on Apple iCloud users, claims watchdog
Attack harvests users' info at iPhone 6 launch
prev story

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
New hybrid storage solutions
Tackling data challenges through emerging hybrid storage solutions that enable optimum database performance whilst managing costs and increasingly large data stores.
Website security in corporate America
Find out how you rank among other IT managers testing your website's vulnerabilities.