PHP flaw threatens Web servers
Published: 23 Jul 2002 09:31 BST
A flaw found in newer versions of the PHP Web server scripting language could allow attackers to crash, and in some cases control, computers over the Internet, an open-source developer group announced on Monday.
The vulnerability affects versions 4.2.0 and 4.2.1 of PHP, according to the PHP Group. The flaw compromises different computer architectures in different ways: Web servers running on Intel IA-32 hardware could crash, while other systems, including Sun Microsystems' Solaris, could allow the attacker to infiltrate the computer.
The flaw occurs because of a problem in the way PHP handles the memory allocated for data recovered from customer forms on Web pages. Such data is known as POST data, after the HTTP command name, and could be formatted by an attacker in a way to compromise the Web server.
"If you are running PHP 4.2.x, you should upgrade as soon as possible," Stefen Esser, a member of the PHP Group and the developer who discovered the scripting flaw, wrote in the advisory. "If you cannot upgrade for whatever reason, the only way to workaround this is to disable all kind of POST requests you server."
The flaw is the second major security hole to affect PHP this year. In February, another vulnerability that affected more versions of the scripting server and that could have led to a greater number of compromises was announced.
The PHP Group has released a new version, PHP 4.2.2, that corrects the flaw.
Once known as Personal Homepage and now as the PHP: Hypertext Preprocessor, PHP is a key part of the standard open-source solution for Web servers. The collection of software making up the solution is commonly referred to as LAMP, where each letter stands for the software component used: the Linux operating system, the Apache Web server, the MySQL database, or the PHP scripting language. Occasionally, a different programming language, Python, is used as the scripting component in LAMP configurations.
For all security-related news, including updates on the latest viruses, hacking exploits and patches, check out ZDNet UK's Viruses and Hacking News Section.
Have your say instantly, and see what others have said. Go to the Security forum.
Let the editors know what you think in the Mailroom.
Did you find this article useful?
60 out of 110 people found this useful
Digg
Slashdot
Del.ici.ous
Stumble
Reddit
