I recently set up an Ubuntu 12.04 server (with Apache 2.2 & PHP 5.3.10). While I was testing it, I noticed in the Apache access logs that an unknown IP address was trying to perform a PHP CGI injection attack, exploiting a known flaw described here:
Luckily I happened to notice this and I prevented the intruder from gaining access to the server, but the injection attack did succeed in changing some of my php.ini settings. According to the description of the vulnerability, the only versions of PHP immune to injection are 5.3.13 and 5.4.3+. I tried to upgrade to 5.5 by using this (apparently popular) unofficial repository:
add-apt-repository ppa:ondrej/php5
It upgraded my PHP but it also destroyed my Apache settings and upgraded Apache to 2.4, which I can't use. So I had to rollback the system.
I then tried to upgrade to PHP 5.3.13 using apt-get, but apparently 5.3.10 is the highest version available from the official Ubuntu 12.04 repos. A little frustrating, to say the least.
So my question is: how can I secure PHP 3.5.10 or install a "safe" version of PHP on Ubuntu 12.04, so that I can prevent the re-occurrence of this kind of attack? I definitely do NOT want Apache 2.4, and I need an LTS server.