Partner With Us

An input-checking vulnerability in PHP that opens the door for hackers to gain Web server access has been patched Monday and users are urged to update as soon as possible.

The patch, found at the PHP.net Web site, corrects the POST parser method in the software standard, which looks at the incoming traffic's headers and allows or rejects the data.

As a result, according to programmers, the vulnerability allows hackers to gain "privileged access" to the Web server in some cases -- letting them either grab the information for their own use or to crash the system.

The only workaround for 4.2.0 and 4.2.1 users is to shut down all incoming POST requests, which administrators are encouraged to do until the patch is implemented.

According to Stephen Esser, a software developer at e-matters.com, he found the vulnerability while putting together an application that processed MIME headers as part of the program.

He said, in his report to PHP.net., the new versions of 4.2 (which featured a revamped multipart/form-data POST handler) allow some incoming traffic to inadvertently get added to the list of allowed MIME headers -- a process that gives hackers a way through the back door.

"A malformed POST request can trigger an error condition, that is not correctly handled. Due to this bug it could happen that an uninitialised struct gets appended to the linked list of mime headers," he reported. "When the lists gets cleaned or destroyed PHP tries to free the pointers that are expected in the struct. Because of the lack of initialisation those pointers contain stuff that was left on the stack by previous function calls."

The bug affects both IBM and Linux machines running the software.