Hole in PHP could give attacker server control


Hole in PHP could give attacker server control

A security hole in the Hypertext Preprocessor (PHP) scripting language used on many Web servers could allow an attacker to execute code on affected systems or even take control of them, according to a security alert released yesterday (22 July) by The PHP Group.

The vulnerability affects PHP 4.2.0 and 4.2.1 and comes as a result of a flaw in the HTTP POST parser component of PHP.

The HTTP POST parser is used to differentiate between files and variables sent by users to a Web server through Web forms, according to the alert. Insufficient checking in the parser could allow an attacker to crash the server, execute code or even take control of the system, The PHP Group said.

The hole can be exploited, locally or remotely, by anyone who can send HTTP POST requests to a server, the advisory said.

Different platforms may respond to attacks differently, however. PHP running on the IA-32 platform, more commonly known as the x86 platform that includes such chips as the Pentium, does not experience the code execution issue, though attack on the vulnerability can still crash PHP or the Web server, according to the advisory.

A latest version of PHP, 4.2.2, has been released to fix the problem. The software can be downloaded at www.php.net/downloads.php.

The full security advisory is also available at www.php.net/release_4_2_2.php.

Email Alerts

Register now to receive ComputerWeekly.com IT-related news, guides and more, delivered to your inbox.
By submitting your personal information, you agree to receive emails regarding relevant products and special offers from TechTarget and its partners. You also agree that your personal information may be transferred and processed in the United States, and that you have read and agree to the Terms of Use and the Privacy Policy.

COMMENTS powered by Disqus  //  Commenting policy