Scripting flaw leaves sites vulnerable

NEWS

A flaw in the common open-source scripting language PHP could allow attackers to crash or compromise a hefty fraction of the nine million servers running the open-source Web software Apache, as well as other Web servers. A member of the PHP engineering team warned Web developers of the software flaws in an advisory on Wednesday, but security experts believe that while some in the Internet underground have tools to exploit the flaw, few people have the resources. "It is not really easy to execute," said Johannes Ullrich, chief technology officer for the SANS (System Administration, Networking, and Security) Internet Storm Center, who obtained a program file that illustrates the vulnerability. A handful of holes appear in different versions of PHP, a scripting language that can be installed on many different Web servers -- including Apache, Microsoft's Internet Information Server (IIS) and iPlanet -- allowing them to create Web pages on the fly from a database of information. PHP software originally stood for Personal Homepage, before the script evolved into a much more complex language. It's best known for letting developers create more-easily modified Web sites based entirely on a collection of open-source software known as LAMP, which includes the Linux operating system, the Apache Web server, the MySQL database, and PHP or Python scripting languages. Survey firm Netcraft estimates that nearly nine million Web servers, about 64 percent, use Apache, and because of PHP's popularity, a large fraction of those sites are likely to have the software installed. While PHP can be installed on other Web site software, the flaws only affect those Web servers running on top of the Linux or Solaris operating systems, according to an advisory released by German security and Internet software company e-Matters. In the past, Microsoft's Internet Information Server has had a slew of problems with flaws in its components that allowed hackers and worms to break in. This time, the software appears not to be vulnerable, even if it's using PHP. The flaws, a collection of heap overflows and problematic boundary checks, could crash vulnerable servers or allow attackers full access to them, said the advisory. Different flaws affect various versions of PHP, from 3.10 to 4.1.1. Ullrich and the PHP Web site recommend that Linux and Solaris Web sites using PHP upgrade their software to the latest version, 4.1.2, which solves the problem. The Computer Emergency Response Team (CERT) Coordination Center at Carnegie Mellon University also warned of the flaw on Wednesday. Ullrich said the problems posed by the vulnerabilities are heightened because security experts are uncertain how widely knowledge of the flaws has spread. "There are these two camps. The disclosure people shout and say they have a new exploit," Ullrich said, referring to "exploit code", or programs capable of taking advantage of the software flaws, "and the non-disclosure people hold on to it and use it to attack certain sites, and trade them in IRC chat rooms." Ullrich believes the latter group may have had exploit code for as long as a month.

For all security-related news, including updates on the latest viruses, hacking exploits and patches, check out ZDNet UK's Viruses and Hacking News Section. Have your say instantly, and see what others have said. Go to the Security forum. Let the editors know what you think in the Mailroom.

Post your comment

In order to post a comment you need to be registered and logged in.

You can also log in with Facebook. Log in or create your ZDNet UK account below

By signing up for this service, you indicate that you agree to our Terms and Conditions and have read and understood our Privacy Policy. Questions about membership? Find the answers in the Community FAQ

ZDNet UK Live

How dare film makers, artists or anybody that invests in creativity stop us pirating their works for free. I want to be able to walk into my local...

5 hours ago by JCB33 on ACTA stumbles in Germany

@GrueMaster. I prefer horses for courses rather than one size fits all. I, and I suspect most other computer users, do not really wish to have...

7 hours ago by Moley on A tale of two distros: Ubuntu and Linux Mint

The product that scares me every time I have to use it is the Office 2007 version of Excel. The first bug that I found was applying the median...

7 hours ago by greycynic on Ten flawed products that derail productivity

Nice review and very informative. One thing I'd like to add (in reply to whs001's 1st question), the main reason to have the same interface from...

9 hours ago by GrueMaster on A tale of two distros: Ubuntu and Linux Mint

I'be been using Mint 12 since the RC came out, and I am far more happy with the Cinnamon, the Mate, and, yes (with extensions), theGnome 3...

9 hours ago by Frederick Wrigley via Facebook on A tale of two distros: Ubuntu and Linux Mint

Excellent article. One small correction, though--although a fresh installation of Linux Mint 12 will, indeed, provide the user with a version of...

10 hours ago by bdantas on A tale of two distros: Ubuntu and Linux Mint

In related news, the ISPs club together to get the members of the Home Affairs Select Committee (ya goofed on that part, ZDNet UK) copies of "The...

11 hours ago by Alan Ralph via Facebook on MPs urge ISPs to take down terrorist material

In related news, the ISPs club together to get the members of the Home Affairs Select Committee (ya goofed on that part, ZDNet UK) copies of "The...

11 hours ago by Alan Ralph via Facebook on MPs urge ISPs to take down terrorist material

For Gnome 2 die-hards, it is possible to add icons to the bottom panel (or top top panel, if you prefer) which provide the exact Gnome 2...

11 hours ago by Moley on A tale of two distros: Ubuntu and Linux Mint

Your comments would seem pretty naive and immature. Your 'solution' appears to be, "gee, let's all just give in to the hackers and give them...

12 hours ago by ramwellian on Cloud computing security: no more oxymoron?

"Interesting thought ... If you installed Win7 as a dual boot on a machine that previously only had Linux, and it wrecked your Linux installation,...

12 hours ago by BugStalker on Windows 7 Declares War on GRUB

This is an excellent summary of Ubuntu and Mint and the interface differences between them. Most such articles take a very partisan position for...

12 hours ago by whs001 on A tale of two distros: Ubuntu and Linux Mint

@ewallace. Not so clear. Anyone can obtain the text, for example from here http://www.ustr.gov/webfm_send/2379. I support ACTA so long as it and...

12 hours ago by Moley on ACTA: Facts, misconceptions and questions

I think WinRT is fantastic. I just wish it was an option for people that didn't want to go through Microsoft's App Store with its attendant...

15 hours ago by 45283 on Why Windows 8 needs architectural hygiene for WOA

Nine people? £30m? Who's back pocket is that lot going in? And IF they say it is for new buildings, what about all the ones the government has...

16 hours ago by Burn-IT on Police set to launch three £30m e-crime hubs

Just to be clear, nobody knows what is in the text of ACTA, here is a photograph of the text of ACTA http://twitpic.com/8h9iju as submitted to the...

17 hours ago by ewallace on ACTA: Facts, misconceptions and questions

Unfortunately main issue is that ASUS is refusing to accept that they make some mistake on this version of asus Transformer prime. 1 - GPS sensor...

18 hours ago by fgvrg56 on Asus Eee Pad Transformer Prime Wi-Fi & GPS problems?

@Marcus A fair question. Just talked with Archos which said it was working on an announcement for next week....

19 hours ago by Ben Woods on Archos confirms G9 Ice Cream Sandwich update schedule

Any update on this, considering the claimed "first week of February"?

20 hours ago by Marcus Karlsson via Facebook on Archos confirms G9 Ice Cream Sandwich update schedule

Bill Goodrich : Just as al_langevin pointed out, with Windows Server 2008 there is no Services for Macintosh anymore. It's gone, not available....

1 day ago by apexwm on Windows Server 2008 drops the ball for Mac compatibility

Featured white papers

Latest jobs

Scripting flaw leaves sites vulnerable

Daily Newsletters

Topics

Related stories

PHP virus sparks debate

Ofcom to make it easier to change broadband service

Google set to build backbone of its 1Gbps fibre network

Nicira reveals network virtualisation details

MPs urge ISPs to take down terrorist material

Post your comment

ZDNet UK Live

Latest in Networking

Ofcom to make it easier to change broadband service

Google set to build backbone of its 1Gbps fibre network

Nicira reveals network virtualisation details

Featured white papers

Latest jobs

Test Analyst - Business Intelligence /Data Warehousing

Test Analyst - Business Intelligence /Data Warehousing

Technical MI Manager - 50-60k - Leeds

Inside ZDNet UK

A tale of two distros: Ubuntu and Linux Mint

2012 Predictions: VCE FastPath, VI SAN Probe & Hadoop

BlackBerry Bold 9790

Case study: How cloud enables growth

Ten factors that make Ubuntu 11.10 a hit

Toshiba Portégé Z830-10P Review

BT's archive: Pictures from the vault

News & Analysis

Reviews

Blogs

Resources

About Us

Member Services

Special Features

Advertising Features

ZDNet UK / News and Analysis / Infrastructure / Networking

Scripting flaw leaves sites vulnerable

Daily Newsletters

Topics

Related stories

Post your comment

Get ZDNet UK's daily newsletter

Enter your email address to sign up

ZDNet UK Live

Latest in Networking

Featured white papers

Latest jobs

Inside ZDNet UK

Resources

About Us

Member Services

Special Features

Advertising Features