====================================================================

                            CERT-Renater

                 Note d'Information No. 2012/VULN210
____________________________________________________________________

DATE                : 04/05/2012

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S) : Systems running PHP versions prior to 5.3.12,
                                                       5.4.2.

======================================================================
http://www.php.net/archive/2012.php#id2012-05-03-1
______________________________________________________________________

PHP 5.3.12 and PHP 5.4.2 Released!

[03-May-2012]

There is a vulnerability in certain CGI-based setups (Apache+mod_php
and nginx+php-fpm are not affected) that has gone unnoticed for at
least 8 years. Section 7 of the CGI spec states:

Some systems support a method for supplying a [sic] array of strings
to the CGI script. This is only used in the case of an `indexed'
query. This is identified by a "GET" or "HEAD" HTTP request with a
URL search string not containing any unencoded "=" characters.
So, requests that do not have a "=" in the query string are treated
differently from those who do in some CGI implementations. For PHP
this means that a request containing ?-s may dump the PHP source
code for the page, but a request that has ?-s&=1 is fine.

A large number of sites run PHP as either an Apache module through
mod_php or using php-fpm under nginx. Neither of these setups are
vulnerable to this. Straight shebang-style CGI also does not appear
to be vulnerable.

If you are using Apache mod_cgi to run PHP you may be vulnerable. To
see if you are, just add ?-s to the end of any of your URLs. If you
see your source code, you are vulnerable. If your site renders
normally, you are not.

To fix this, update to PHP 5.3.12 or PHP 5.4.2.

We recognize that since CGI is a rather outdated way to run PHP, it
may not be feasible to upgrade these sites to a modern version of
PHP. An alternative is to configure your web server to not let these
types of requests with query strings starting with a "-" and not
containing a "=" through. Adding a rule like this should not break
any sites. For Apache using mod_rewrite it would look like this:

          RewriteCond %{QUERY_STRING} ^(%2d|-)[^=]+$ [NC]
          RewriteRule ^(.*) $1? [L]

If you are writing your own rule, be sure to take the
urlencoded ?%2ds version into account.

Making a bad week worse, we had a bug in our bug system that toggled
the private flag of a bug report to public on a comment to the bug
report causing this issue to go public before we had time to test
solutions to the level we would like. Please report any issues
via bugs.php.net.

For source downloads of PHP 5.3.12 and PHP 5.4.2 please visit our
downloads page, Windows binaries can be found on
windows.php.net/download/. A ChangeLog exists.


======================================================================

=========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
=========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44          +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41          +
+ 75013 Paris           | email: certsvp@renater.fr     +
=========================================================