1

I recently set up an Ubuntu 12.04 server (with Apache 2.2 & PHP 5.3.10). While I was testing it, I noticed in the Apache access logs that an unknown IP address was trying to perform a PHP CGI injection attack, exploiting a known flaw described here:

http://www.osvdb.org/81633

Luckily I happened to notice this and I prevented the intruder from gaining access to the server, but the injection attack did succeed in changing some of my php.ini settings. According to the description of the vulnerability, the only versions of PHP immune to injection are 5.3.13 and 5.4.3+. I tried to upgrade to 5.5 by using this (apparently popular) unofficial repository:

add-apt-repository ppa:ondrej/php5

It upgraded my PHP but it also destroyed my Apache settings and upgraded Apache to 2.4, which I can't use. So I had to rollback the system.

I then tried to upgrade to PHP 5.3.13 using apt-get, but apparently 5.3.10 is the highest version available from the official Ubuntu 12.04 repos. A little frustrating, to say the least.

So my question is: how can I secure PHP 3.5.10 or install a "safe" version of PHP on Ubuntu 12.04, so that I can prevent the re-occurrence of this kind of attack? I definitely do NOT want Apache 2.4, and I need an LTS server.

Improve this question
2
  • Why can't you use Apache 2.4?
    – staticsan
    Jan 28, 2014 at 3:04
  • Because I'm using other software that requires 2.2 (it's just part of the job and there's nothing I can do about it).
    – Phll
    Jan 28, 2014 at 3:18

1 Answer 1

Reset to default
2

Canonical back ports these fixes for Ubuntu. The incident that you found was fixed in 5.3.10-1ubuntu3.2. It appears that the latest version is 5.3.10-1ubuntu3.9. You can go back and look at the change logs for the various releases.

I suggest that you keep your distro up to date. These commands should do it.

sudo apt-get update
sudo apt-get upgrade

If you're brave, cron that. If not, run it frequently to keep your system up to the latest patch level.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .