Crackers Exploit PHP Vulnerabilities

Security researchers have found seven separate vulnerabilities in several versions of the widely used PHP scripting language and warn that crackers are circulating exploit code for at least one of the flaws.

The problem lies in the way that PHP handles multipart-data POST requests, through which users can upload files or other content to a Web server. Specifically, there are several flaws in the php_mime_split function that an attacker could use to run arbitrary code on a vulnerable server, according to a bulletin released by Stefan Esser of e-matters GmbH, of Koln, Germany, and a member of the PHP development team.

The PHP team has released an updated version of the language that fixes the security problems. PHP, which began as a project of the Apache Software Foundation, is most often used on Apache Web servers, which make up nearly 60 percent of the servers in the Internet, according to a survey by Netcraft, a U.K. security testing company. But all major Web servers support PHP, as well.

Most of the vulnerabilities are relevant only to machines running Sun Microsystems Inc.s Solaris and various versions of Linux.

The vulnerabilities are all buffer overflows, although some are more difficult to exploit than others, according to Essers advisory. For a full list of the flaws and the affected versions of PHP, see the advisory at http://security.e-matters.de/advisories/012002.html.

A working exploit for one of the flaws is making the rounds in the security underground and contains exploit vectors for versions of Apache running on Debian and Red Hat Inc.s Linux distribution, according to Internet Security Systems Inc., in Atlanta.

The company says its X-Force research team has verified that the exploit works, although somewhat inconsistently.