PHP patches actively exploited CGI vulnerability

PHP 5.4.3 and PHP 5.3.13 include fix for PHP CGI vulnerability that is being actively exploited to compromise websites

The PHP Group has released PHP 5.4.3 and PHP 5.3.13 on Tuesday in order to address two remote code execution vulnerabilities, one of which is being actively exploited by hackers.

"The releases complete a fix for a vulnerability in CGI-based setups (CVE-2012-2311)," the PHP developers said in the release notes. Additionally, PHP 5.4.3 fixes a buffer overflow vulnerability, identified as CVE-2012-2329, in the apache_request_headers() function.

The CVE-2012-2311 vulnerability, also known as CVE-2012-1823, was publicly disclosed last week and prompted the PHP Group to release PHP 5.3.12 and PHP 5.4.2 as emergency security updates in order to resolve it, on May 3.

Unfortunately, the initial patch proved to be ineffective against all variations of the exploit for CVE-2012-1823, and the manual workaround suggested by the PHP developers when releasing the emergency updates was easy to bypass as well.

The PHP developers investigated the issue further and published a new workaround on Sunday. They also promised to have a new working patch ready on Tuesday.

However, hackers immediately took advantage of the situation and started to exploit the flaw in order to compromise websites, according to reports from several security firms.

Researchers from security firm Trustwave announced that the company recorded exploitation attempts for the PHP CGI vulnerability on its honeypot servers -- systems designed to attract attackers. The attacks were particularly interesting because they were designed to bypass the second workaround published by the PHP Group on Sunday.

"One of the major goals of these attacks are to try and download/install webshells and backdoors," researchers from Trustwave's SpiderLabs said in a blog post on Monday.

Web hosting provider Dreamhost has also seen a large number of attacks trying to exploit this vulnerability, according to Trustwave researchers who exchanged information with Dreamhost's security team. In total, the Web hosting company recorded 234,076 exploit attempts against 151,275 unique domains, the Trustwave researchers said.

Security researchers from website integrity monitoring firm Sucuri Security also reported seeing successful CVE-2012-1823 exploitation attempts since the weekend that resulted in the targeted websites being compromised.

The attackers are first sending a malicious query that includes the "-s" php-cgi flag to test if the targeted websites are vulnerable and then installed a backdoor through a query with the "-d" flag, Sucuri's chief technology officer, Daniel Cid, said in a blog post on Tuesday. "It is also important to note that even though we are only seeing those two 'flags' being used (-s and -d), php-cgi has many options and any of them can be used."

Cid advised Web servers administrators who run PHP through php-cgi, to update to the new PHP 5.4.3 or PHP 5.3.13, or to modify their setup so that it uses the PHP module (mod_php) under Apache or FastCGI, which is not vulnerable.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.
Lucian Constantin

Lucian Constantin

IDG News Service
Show Comments

Essentials

Mobile

Exec

Budget

Back To Business Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Christopher Low

Brother RJ-4230B

This small mobile printer is exactly what I need for invoicing and other jobs such as sending fellow tradesman details or step-by-step instructions that I can easily print off from my phone or the Web.

Aysha Strobbe

Microsoft Office 365/HP Spectre x360

Microsoft Office continues to make a student’s life that little bit easier by offering reliable, easy to use, time-saving functionality, while continuing to develop new features that further enhance what is already a formidable collection of applications

Michael Hargreaves

Microsoft Office 365/Dell XPS 15 2-in-1

I’d recommend a Dell XPS 15 2-in-1 and the new Windows 10 to anyone who needs to get serious work done (before you kick back on your couch with your favourite Netflix show.)

Maryellen Rose George

Brother PT-P750W

It’s useful for office tasks as well as pragmatic labelling of equipment and storage – just don’t get too excited and label everything in sight!

Cathy Giles

Brother MFC-L8900CDW

The Brother MFC-L8900CDW is an absolute stand out. I struggle to fault it.

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?