Major Security Hole in PHP File Upload

[JoshT]

http://www.cert.org/advisories/CA-2002-05.html

Everyone update your servers.

[scoutt]

thanks Josh..........

[TheGoldenShogun]

Thanks for the heads up. I'm in-experienced with the setting up of new versions of PHP and patches and stuff. I went to their website and they didn't have any Download's for Red Hat Linux servers. Does anybody know where to get that patch at?

[scoutt]

as far as I know, Linux is Linux is Linux. doesn't matter if it is redhat or mandrake it should still be one php file.

[JoshT]

Red Hat should post an RPM on their site, or use the "up2date" tool that comes with their distro. Else, get the PHP source code and compile it yourself.

[TheGoldenShogun]

hmm... I'm doing the second option as we speak.. Trying to recompile it. I untarred it and did the make install thing. Anybody know what else needs to be done?

[filburt1]

Erm, is it just me or is there no Win32 download for 4.1.2?

[scoutt]

not you. they usually come out with win32 about a month or 2 later. as far as I know they still don't have 4.11 as win32.

[filburt1]

Bummer, so I just have a big ol' hole until then?

[ubunreal69]

do u have to change any setting thiny's in PHP to enable file uploads ?? cos i cant seem to get it to work

[scoutt]

well if your code is correct

then you shouldn't have to do anything. unless your isp has disabled it.

[ubunreal69]

Originally posted by scoutt
well if your code is correct

then you shouldn't have to do anything. unless your isp has disabled it.

lol, i host everything myself (ASP, PHP, MySQL) on my one and only ****box computer. (P166, 32MB, 4GB)

anyway, when i have time to give the code another try i'll consult the forum. thanx scoutt

[Cander]

not to worry fillby if you have php4 as the vulnerabilites only affect Linux/solaris. There is an affect for windows in php 3 though.