News Feed
Sections




News Archive
Looking for more information on how to do PHP the right way? Check out PHP: The Right Way

PHP.net:
PHP 5.3.12 and PHP 5.4.2 Released!
May 04, 2012 @ 07:19:08

The PHP project has officially released the latest versions in both the 5.3.x and 5.4.x series in response to a bug that was found in the CGI setup of certain server+PHP configurations.

There is a vulnerability in certain CGI-based setups (Apache+mod_php and nginx+php-fpm are not affected) that has gone unnoticed for at least 8 years. Section 7 of the CGI spec states: 'Some systems support a method for supplying a [sic] array of strings to the CGI script. This is only used in the case of an `indexed' query. This is identified by a "GET" or "HEAD" HTTP request with a URL search string not containing any unencoded "=" characters.'

A large number of sites run PHP as either an Apache module through mod_php or using php-fpm under nginx. Neither of these setups are vulnerable to this. Straight shebang-style CGI also does not appear to be vulnerable. If you are using Apache mod_cgi to run PHP you may be vulnerable. To see if you are, just add ?-s to the end of any of your URLs. If you see your source code, you are vulnerable. If your site renders normally, you are not.

You can download this latest version from the downloads page for the source releases or windows.php.net for the Windows binaries. You can look at the Changelog if you'd like more details on the update.

0 comments voice your opinion now!
release bugfix cgi request handling apache modcgi


blog comments powered by Disqus

Similar Posts

Stefan Esser's Blog: Suhosin Extension 0.9.17 released

Pierre-Alain Joye's Blog: Howto use a single php.ini for cli/cgi with htscanner, use 0.7.0 or later

Dhiraj Patra's Blog: Running PHP Scripts with Cron

Community News: PHP 5.2.1 Released

Dan Scott's Blog: Double-barreled PHP releases


Community Events

Don't see your event here?
Let us know!


unittest example introduction voicesoftheelephpant video api podcast extension language php7 laravel release laravel5 library opinion series version framework community interview

All content copyright, 2015 PHPDeveloper.org :: info@phpdeveloper.org - Powered by the Solar PHP Framework