Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT Security Bulletin
ASB-2012.0066
A vulnerability has been identified in PHP prior to versions
5.3.12 and 5.4.2
4 May 2012
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: PHP
Operating System: UNIX variants (UNIX, Linux, OSX)
Windows
Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated
Access Confidential Data -- Remote/Unauthenticated
Resolution: Mitigation
CVE Names: CVE-2012-1823
Member content until: Sunday, June 3 2012
Comment: Some sources have stated that these updates do not correct the
reported vulnerability, and as such additional mitigation information
has been provided.
OVERVIEW
A vulnerability has been identified in PHP prior to versions 5.3.12 and
5.4.2. [1]
IMPACT
The vendor has provided the following details regarding this
vulnerability which has been assigned CVE-2012-1823:
"There is a vulnerability in certain CGI-based setups (Apache+mod_php
and nginx+php-fpm are not affected) that has gone unnoticed for at
least 8 years. Section 7 of the CGI spec states:
Some systems support a method for supplying a [sic] array of strings to
the CGI script. This is only used in the case of an `indexed' query.
This is identified by a "GET" or "HEAD" HTTP request with a URL search
string not containing any unencoded "=" characters.
So, requests that do not have a "=" in the query string are treated
differently from those who do in some CGI implementations. For PHP
this means that a request containing ?-s may dump the PHP source code
for the page, but a request that has ?-s&=1 is fine.
A large number of sites run PHP as either an Apache module through
mod_php or using php-fpm under nginx. Neither of these setups are
vulnerable to this. Straight shebang-style CGI also does not appear to
be vulnerable.
If you are using Apache mod_cgi to run PHP you may be vulnerable. To
see if you are, just add ?-s to the end of any of your URLs. If you
see your source code, you are vulnerable. If your site renders
normally, you are not." [1]
While the vendor states that the updated version of PHP will correct
this issue, the Einbbazen blog where the original disclosure of the
vulnerability was made has stated that:
"The new PHP release is buggy. You can use their mitigation mod_rewrite
rule, but the patch and new released versions do not fix the
problem." [2]
The Eindbazen blog also provides additional methods to mitigate this
issue, however as these are not official vendor supplied mitigations
they should be used at your own risk. [2]
MITIGATION
The vendor has provided the following details regarding available
updates and a workaround:
"To fix this, update to PHP 5.3.12 or PHP 5.4.2.
We recognize that since CGI is a rather outdated way to run PHP, it may
not be feasible to upgrade these sites to a modern version of PHP. An
alternative is to configure your web server to not let these types of
requests with query strings starting with a "-" and not containing a
"=" through. Adding a rule like this should not break any sites. For
Apache using mod_rewrite it would look like this:
RewriteCond %{QUERY_STRING} ^(%2d|-)[^=]+$ [NC]
RewriteRule ^(.*) $1? [L]
If you are writing your own rule, be sure to take the urlencoded ?%2ds
version into account." [1]
REFERENCES
[1] PHP 5.3.12 and PHP 5.4.2 Released!
http://www.php.net/archive/2012.php#id2012-05-03-1
[2] Eindbazen PHP-CGI advisory (CVE-2012-1823)
http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/
AusCERT has made every effort to ensure that the information contained
in this document is accurate. However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBT6Naru4yVqjM2NGpAQJrNRAAk+kcLzaV3I0/ZXnUYXF89J2/mxDhq6Xe
nEqk6VSOVtJjrdpna5ulWuR0z1qjT84A1QHxPQvbuFqwzEtTAbpL5Fj5QRF1VbgL
GEL4ue1fVWBsUn5EFN4LT1TY/T+x4jK8QuL4l+hF4XRjDi7N5OeVrdngyORiBL28
R/GJ3XFMNuL+rUJjWqTlkeEUb6swNRbn+I4gkcwzqpG8q07MswKIGJMZWLu+kVDX
iPZviJgof07Ng6sPa2vEAZOlMdgfwaJgFORtptNyTT2Nw9Ag8mDxFeGz08fzrBwv
X511uBO51dLkk18esJEzPmsg6/ehd+6x89fVeHYd3nsOKX6RKkwVjfS3NlBe3XAU
BTT4RMS+t59sV1GCv1TL+FYRZq7Oyc3QdrnMAx/DEI8L9Ms90kAD1Xbj+yNW1kTU
51BIRlPprdGkP3a7IW+ev6crTARfBHAolz3e1u2Ru0l//S3LygKMIOG49zsAJZYL
BVzSgZqf7TBSE/y2Ys1DKi5A2gbvlxVsD/siagwfgYEs9pZmKwxNJt0QWLpC6Fes
ky+1KwFYcz4JlIOqHOQP8or+z1/mRa3jNo5Rv51lgDhzcGup4f01nYnDXEXkS2/U
6MxeA2q3RxaKDSwIxX6mzO18r6QJiaSucnbRxJTwgSpIFXRBF4w2c9bICOqVLfh5
Q+qho63EaME=
=t/K4
-----END PGP SIGNATURE-----