Scripting flaw threatens Web servers

A flaw found in newer versions of the PHP Web server scripting language could allow attackers to crash, and in some cases control, computers over the Internet, an open-source developer group announced Monday.

The vulnerability affects versions 4.2.0 and 4.2.1 of PHP, according to the PHP Group. The flaw compromises different computer architectures in different ways: Web servers running on Intel IA-32 hardware could crash, while other systems, including Sun Microsystems' Solaris, could allow the attacker to infiltrate the computer.

The flaw occurs because of a problem in the way PHP handles the memory allocated for data recovered from customer forms on Web pages. Such data is known as POST data, after the HTTP command name, and could be formatted by an attacker in a way to compromise the Web server.

"If you are running PHP 4.2.x, you should upgrade as soon as possible," Stefen Esser, a member of the PHP Group and the developer who discovered the scripting flaw, wrote in the advisory. "If you cannot upgrade for whatever reason, the only way to workaround this is to disable all kind of POST requests you server."

The flaw is the second major security hole to affect PHP this year. In February, another vulnerability that affected more versions of the scripting server and that could have led to a greater number of compromises was announced.

The PHP Group has released a new version, PHP 4.2.2, that corrects the flaw.

Once known as Personal Homepage and now as the PHP: Hypertext Preprocessor, PHP is a key part of the standard open-source solution for Web servers. The collection of software making up the solution is commonly referred to as LAMP, where each letter stands for the software component used: the Linux operating system, the Apache Web server, the MySQL database, or the PHP scripting language. Occasionally, a different programming language, Python, is used as the scripting component in LAMP configurations.