PHP patches actively exploited CGI vulnerability

PHP 5.4.3 and PHP 5.3.13 include fix for PHP CGI vulnerability that is being actively exploited to compromise websites

The PHP Group has released PHP 5.4.3 and PHP 5.3.13 on Tuesday in order to address two remote code execution vulnerabilities, one of which is being actively exploited by hackers.

"The releases complete a fix for a vulnerability in CGI-based setups (CVE-2012-2311)," the PHP developers said in the release notes. Additionally, PHP 5.4.3 fixes a buffer overflow vulnerability, identified as CVE-2012-2329, in the apache_request_headers() function.

The CVE-2012-2311 vulnerability, also known as CVE-2012-1823, was publicly disclosed last week and prompted the PHP Group to release PHP 5.3.12 and PHP 5.4.2 as emergency security updates in order to resolve it, on May 3.

Unfortunately, the initial patch proved to be ineffective against all variations of the exploit for CVE-2012-1823, and the manual workaround suggested by the PHP developers when releasing the emergency updates was easy to bypass as well.

The PHP developers investigated the issue further and published a new workaround on Sunday. They also promised to have a new working patch ready on Tuesday.

However, hackers immediately took advantage of the situation and started to exploit the flaw in order to compromise websites, according to reports from several security firms.

Researchers from security firm Trustwave announced that the company recorded exploitation attempts for the PHP CGI vulnerability on its honeypot servers -- systems designed to attract attackers. The attacks were particularly interesting because they were designed to bypass the second workaround published by the PHP Group on Sunday.

"One of the major goals of these attacks are to try and download/install webshells and backdoors," researchers from Trustwave's SpiderLabs said in a blog post on Monday.

Web hosting provider Dreamhost has also seen a large number of attacks trying to exploit this vulnerability, according to Trustwave researchers who exchanged information with Dreamhost's security team. In total, the Web hosting company recorded 234,076 exploit attempts against 151,275 unique domains, the Trustwave researchers said.

Security researchers from website integrity monitoring firm Sucuri Security also reported seeing successful CVE-2012-1823 exploitation attempts since the weekend that resulted in the targeted websites being compromised.

The attackers are first sending a malicious query that includes the "-s" php-cgi flag to test if the targeted websites are vulnerable and then installed a backdoor through a query with the "-d" flag, Sucuri's chief technology officer, Daniel Cid, said in a blog post on Tuesday. "It is also important to note that even though we are only seeing those two 'flags' being used (-s and -d), php-cgi has many options and any of them can be used."

Cid advised Web servers administrators who run PHP through php-cgi, to update to the new PHP 5.4.3 or PHP 5.3.13, or to modify their setup so that it uses the PHP module (mod_php) under Apache or FastCGI, which is not vulnerable.

Join the CSO newsletter!

Error: Please check your email address.

More about ApacheCGIHewlett-Packard AustraliaHPTrustwave

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Lucian Constantin

Latest Videos

  • 150x50

    CSO Webinar: Will your data protection strategy be enough when disaster strikes?

    Speakers: - Paul O’Connor, Engagement leader - Performance Audit Group, Victorian Auditor-General’s Office (VAGO) - Nigel Phair, Managing Director, Centre for Internet Safety - Joshua Stenhouse, Technical Evangelist, Zerto - Anthony Caruana, CSO MC & Moderator

    Play Video

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

More videos

Blog Posts

Market Place