Go Back   vb.org Archive > vBulletin 3 Discussion > vB3 Programming Discussions
FAQ Community Calendar Today's Posts Search

Reply
 
Thread Tools Display Modes
  #1  
Old 07-24-2002, 01:44 AM
JJR512's Avatar
JJR512 JJR512 is offline
 
Join Date: Oct 2001
Location: Glen Burnie, MD, USA
Posts: 710
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default Hole in PHP could give attacker server control

This is not a request for help. This is some news for your information.
Quote:
Hole in PHP could give attacker server control
ITworld.com 7/22/02

Sam Costello, IDG News Service, Boston Bureau
A security hole in the PHP (PHP: Hypertext Preprocessor) scripting language used on many Web servers could allow an attacker to execute code on affected systems or even take control of them, according to a security alert released Monday by The PHP Group.

The vulnerability affects PHP 4.2.0 and 4.2.1 and comes as a result of a flaw in the HTTP POST parser component of PHP. The HTTP POST parser is used to differentiate between files and variables sent by users to a Web server through Web forms, according to the alert. Insufficient checking in the parser could allow an attacker to crash the server, execute code or even take control of the system, The PHP Group said.

The hole can be exploited, locally or remotely, by anyone who can send HTTP POST requests to a server, the advisory said.

Different platforms may respond to attacks differently, however. PHP running on the IA-32 platform, more commonly-known as the x86 platform that includes such chips as the Pentium, does not experience the code execution issue, though attack on the vulnerability can still crash PHP or the Web server, according to the advisory.

A new version of PHP, 4.2.2, has been released to fix the problem. The new version of the software can be downloaded at http://www.php.net/downloads.php. The full security advisory is also available at http://www.php.net/release_4_2_2.php.

Sam Costello is a correspondent for the IDG News Service.
From ITworld.com
Reply With Quote
  #2  
Old 07-24-2002, 02:05 AM
DrkFusion's Avatar
DrkFusion DrkFusion is offline
 
Join Date: Nov 2001
Posts: 1,926
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

Im sure this will be fixed very quickly.
Reply With Quote
  #3  
Old 07-24-2002, 02:17 AM
JJR512's Avatar
JJR512 JJR512 is offline
 
Join Date: Oct 2001
Location: Glen Burnie, MD, USA
Posts: 710
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

It's already been fixed, according to the article: "A new version of PHP, 4.2.2, has been released to fix the problem." So, any of you that run your own servers, should look into upgrading, and those of you whose sites are hosted should make sure your webhosting company is aware of this.
Reply With Quote
  #4  
Old 07-24-2002, 02:32 AM
DrkFusion's Avatar
DrkFusion DrkFusion is offline
 
Join Date: Nov 2001
Posts: 1,926
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

Cool, I will be upgrading php in 5 minutes, thanks for that update, I didn't know about it.

Drk
Reply With Quote
  #5  
Old 07-24-2002, 06:59 AM
Admin's Avatar
Admin Admin is offline
Coder
 
Join Date: Oct 2023
Location: Server
Posts: 1
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

The Jelsoft server has been upgraded, in case anyone thinks about trying...
Reply With Quote
  #6  
Old 07-24-2002, 08:28 AM
Sparkz's Avatar
Sparkz Sparkz is offline
 
Join Date: Nov 2001
Posts: 544
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

Downloading the new version just after it was released was a major pain in the butt!

Imagine fighting for a download slot with all those other maniacs :P
Reply With Quote
  #7  
Old 07-24-2002, 08:31 AM
Admin's Avatar
Admin Admin is offline
Coder
 
Join Date: Oct 2023
Location: Server
Posts: 1
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

Just use one of the mirrors... That's what I did.
Reply With Quote
  #8  
Old 07-24-2002, 08:34 AM
Sparkz's Avatar
Sparkz Sparkz is offline
 
Join Date: Nov 2001
Posts: 544
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

All the close mirrors were just as slow...
Reply With Quote
  #9  
Old 07-24-2002, 01:53 PM
DrkFusion's Avatar
DrkFusion DrkFusion is offline
 
Join Date: Nov 2001
Posts: 1,926
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

Download it at download.com lol...the fastest you can get with those maniacks. U would have to use the linux downloads if u have a linux server, and windows if windows server and so on....but it works, though I didn't download mine there.

Drk
Reply With Quote
  #10  
Old 07-24-2002, 05:02 PM
Admin's Avatar
Admin Admin is offline
Coder
 
Join Date: Oct 2023
Location: Server
Posts: 1
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

Quote:
Originally posted by DrkFusion
U would have to use the linux downloads if u have a linux server, and windows if windows server
Let's take a moment to digest this complicated logic of yours...
Reply With Quote
Reply


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump


All times are GMT. The time now is 02:36 PM.


Powered by vBulletin® Version 3.8.12 by vBS
Copyright ©2000 - 2025, vBulletin Solutions Inc.
X vBulletin 3.8.12 by vBS Debug Information
  • Page Generation 0.10953 seconds
  • Memory Usage 2,251KB
  • Queries Executed 11 (?)
More Information
Template Usage:
  • (1)SHOWTHREAD
  • (1)ad_footer_end
  • (1)ad_footer_start
  • (1)ad_header_end
  • (1)ad_header_logo
  • (1)ad_navbar_below
  • (1)ad_showthread_beforeqr
  • (1)ad_showthread_firstpost
  • (1)ad_showthread_firstpost_sig
  • (1)ad_showthread_firstpost_start
  • (2)bbcode_quote
  • (1)footer
  • (1)forumjump
  • (1)forumrules
  • (1)gobutton
  • (1)header
  • (1)headinclude
  • (1)navbar
  • (3)navbar_link
  • (120)option
  • (1)pagenav
  • (1)pagenav_curpage
  • (1)pagenav_pagelink
  • (10)post_thanks_box
  • (10)post_thanks_button
  • (1)post_thanks_javascript
  • (1)post_thanks_navbar_search
  • (10)post_thanks_postbit_info
  • (10)postbit
  • (10)postbit_onlinestatus
  • (10)postbit_wrapper
  • (1)spacer_close
  • (1)spacer_open
  • (1)tagbit_wrapper 

Phrase Groups Available:
  • global
  • inlinemod
  • postbit
  • posting
  • reputationlevel
  • showthread
Included Files:
  • ./showthread.php
  • ./global.php
  • ./includes/init.php
  • ./includes/class_core.php
  • ./includes/config.php
  • ./includes/functions.php
  • ./includes/class_hook.php
  • ./includes/modsystem_functions.php
  • ./includes/functions_bigthree.php
  • ./includes/class_postbit.php
  • ./includes/class_bbcode.php
  • ./includes/functions_reputation.php
  • ./includes/functions_post_thanks.php 

Hooks Called:
  • init_startup
  • init_startup_session_setup_start
  • init_startup_session_setup_complete
  • cache_permissions
  • fetch_threadinfo_query
  • fetch_threadinfo
  • fetch_foruminfo
  • style_fetch
  • cache_templates
  • global_start
  • parse_templates
  • global_setup_complete
  • showthread_start
  • showthread_getinfo
  • forumjump
  • showthread_post_start
  • showthread_query_postids
  • showthread_query
  • bbcode_fetch_tags
  • bbcode_create
  • showthread_postbit_create
  • postbit_factory
  • postbit_display_start
  • post_thanks_function_post_thanks_off_start
  • post_thanks_function_post_thanks_off_end
  • post_thanks_function_fetch_thanks_start
  • post_thanks_function_fetch_thanks_end
  • post_thanks_function_thanked_already_start
  • post_thanks_function_thanked_already_end
  • fetch_musername
  • postbit_imicons
  • bbcode_parse_start
  • bbcode_parse_complete_precache
  • bbcode_parse_complete
  • postbit_display_complete
  • post_thanks_function_can_thank_this_post_start
  • pagenav_page
  • pagenav_complete
  • tag_fetchbit_complete
  • forumrules
  • navbits
  • navbits_complete
  • showthread_complete