Eindbazen PHP-CGI vulnerability (CVE-2012-2311)

Seems to be that the official PHP patch doesn't work. What about Webfaction's own patch? Are webfaction servers (php-cgi) safe now?

Eindbazen source:

The new PHP versions as well as the official php patch contain a bug which makes the fix trivial to bypass. Use our mitigations for now.
New versions of PHP which incorporate this revised fix will be released soon. The issue that the bug was not initially properly fixed is being tracked as CVE-2012-2311.

cgi php

asked May 04 '12 at 05:09

wallypally
1●2

edited May 04 '12 at 05:10

One Answer:

oldest newest most voted

0	Hi, We've already deployed our own patch (wrapper that strips the extra arguments). Our servers are safe. answered May 04 '12 at 05:29 todork 1096●4 Thanks for your reply. (May 04 '12 at 06:00) wallypally

Your answer

If you have an answer to the above question, then use the form below. Otherwise, use the appropriate 'add new comment' button above to post your feedback.

toggle preview

community wiki

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Tags:

php ×150
cgi ×24

Asked: May 04 '12 at 05:09

Seen: 818 times

Last updated: May 04 '12 at 06:00

Eindbazen PHP-CGI vulnerability (CVE-2012-2311)

Follow this question

Got questions? We have answers!

Related questions