Feeds

PHP devs lob second patch at super-critical CGI bug

If at first you don't succeed, compile, compile again

The Power of One eBook: Top reasons to choose HP BladeSystem

The developers of PHP have released updates to thwart fresh attacks against systems that use the scripting language to dynamically generate web pages.

All users are encouraged to upgrade to PHP 5.4.3 or PHP 5.3.13, as appropriate, after a serious security bug in PHP-CGI-based setups was disclosed. Developers attempted to fix this long-standing, but only recently discovered, flaw in a new version on 3 May, before deciding the fix was incomplete and releasing a new set of patches on Tuesday, 8 May.

This is just as well because the PHP-CGI vulnerability has become the target of a series of attacks against sites hosted by DreamHost and others over recent days. Attempts to exploit the bug were witnessed by net honeypots maintained by security researchers at TrustWave SpiderLabs. The assaults were ultimately designed to plant backdoors on vulnerable web servers, as an advisory by TrustWave explains.

The PHP-CGI remote code execution bug was discovered by security researchers, who traced the flaw to changes introduced in the codebase way back in 2004. The Eindbazen crew told PHP developers about the bug, and work was going on behind the scenes to develop a fix. However the wheels fell off this project after discussions surrounding the security hole were accidentally made public, exposing the existence of the flaw to world+dog before a patch was ready.

This, in turn, prompted the decision to rush out updates that failed to close the hole before this week's release of a second set of security updates.

PHP 5.4.3 also addresses a buffer overflow vulnerability in the apache_request_headers, as explained in an advisory here. ®

Designing a Defense for Mobile Applications

More from The Register

next story
DARPA-derived secure microkernel goes open source tomorrow
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
Four fake Google haxbots hit YOUR WEBSITE every day
Goog the perfect ruse to slip into SEO orfice
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.