UBB.Developers Forums Community Development Programming PHP and Server-side Scripting PHP Security Advisory: Versions 4.2.0 and 4.2.1

Issued on: July 22, 2002
Software: PHP versions 4.2.0 and 4.2.1
Platforms: All

The PHP Group has learned of a serious security vulnerability in PHP versions 4.2.0 and 4.2.1. An intruder may be able to execute arbitrary code with the privileges of the web server. This vulnerability may be exploited to compromise the web server and, under certain conditions, to gain privileged access.

Description
PHP contains code for intelligently parsing the headers of HTTP POST requests. The code is used to differentiate between variables and files sent by the user agent in a "multipart/form-data" request. This parser has insufficient input checking, leading to the vulnerability.

The vulnerability is exploitable by anyone who can send HTTP POST requests to an affected web server. Both local and remote users, even from behind firewalls, may be able to gain privileged access.

Impact
Both local and remote users may exploit this vulnerability to compromise the web server and, under certain conditions, to gain privileged access. So far only the IA32 platform has been verified to be safe from the execution of arbitrary code. The vulnerability can still be used on IA32 to crash PHP and, in most cases, the web server.

Read more at: http://www.php.net/release_4_2_2.php

This is one of the reasons to use the referer check. (will lesson the chance of things being posted from off site getting anywhere)

Thanks for the heads up.

In regards to the referrer check, what about members who may be behind a firewall? I know that I've had trouble in the past with some members not being able to post when I had that enabled. Is there something that I can tell the affected members to do, so that I can re-enable the referrer check?

Figures. I just did a new compile of PHP 4.2.1 (and had loads of trouble with it not installing correctly, for some reason make install didn't install...). I checked the site for a new version before I compiled, when I was finished I looked here and saw this. The Swedish mirror hadn't been updated with it so I didn't see it. =/

I think this must have happened every time I compile something, so if you want a new version of a program, just tell me to compile it and a release should be out soon. =P

If I want it to rain will you wash your car?

posted by JustDave:

---

This is one of the reasons to use the referer check. (will lesson the chance of things being posted from off site getting anywhere)

Thanks for the heads up.

---

But a hacker could still send you a header that exploits the vulnerability while using your forum. The referer check is great for keeping a board from being spammed by packets coming from another site, but it won't stop a hacker who has compromised another sever before going to your forum (a common technique used to make it difficult for you to track down the source of an attack).

I agree that the referer check makes it a little more difficult to "attack" a board, but it's like a lock: It just keeps the honest people out...

If someone figures out a way to spoof the referer section of an HTTP get request then the referer check would be completely mute...

I'm sorry, I don't have a car. Besides, I think rain only works locally, it won't rain all over the globe.

posted by Gardener:

---

I'm sorry, I don't have a car. Besides, I think rain only works locally, it won't rain all over the globe.

---

Darn...

I would think that most popular firewalls have the referer blocking as an option. It's a matter of getting the the user to turn the option off and that's not always an easy task. LoL

I use ZoneAlarm myself and it does not have referer blocking. (that I can find)

posted by JustDave:

---

I would think that most popular firewalls have the referer blocking as an option. It's a matter of getting the the user to turn the option off and that's not always an easy task. LoL

I use ZoneAlarm myself and it does not have referer blocking. (that I can find)

---

The Pro version of Zone Alarm does do referer checking, but they call it "Privacy". Unfortunately they don't explain what it is, so I get a few complaints from people who have it enabled and they can't post on the board. Same for Norton's firewall package... *sigh* If they would only explain what the're doing instead of providing "security through obscurity"