Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I recently set up an Ubuntu 12.04 server (with Apache 2.2 & PHP 5.3.10). While I was testing it, I noticed in the Apache access logs that an unknown IP address was trying to perform a PHP CGI injection attack, exploiting a known flaw described here:

http://www.osvdb.org/81633

Luckily I happened to notice this and I prevented the intruder from gaining access to the server, but the injection attack did succeed in changing some of my php.ini settings. According to the description of the vulnerability, the only versions of PHP immune to injection are 5.3.13 and 5.4.3+. I tried to upgrade to 5.5 by using this (apparently popular) unofficial repository:

add-apt-repository ppa:ondrej/php5

It upgraded my PHP but it also destroyed my Apache settings and upgraded Apache to 2.4, which I can't use. So I had to rollback the system.

I then tried to upgrade to PHP 5.3.13 using apt-get, but apparently 5.3.10 is the highest version available from the official Ubuntu 12.04 repos. A little frustrating, to say the least.

So my question is: how can I secure PHP 3.5.10 or install a "safe" version of PHP on Ubuntu 12.04, so that I can prevent the re-occurrence of this kind of attack? I definitely do NOT want Apache 2.4, and I need an LTS server.

share|improve this question
    
Why can't you use Apache 2.4? –  staticsan Jan 28 at 3:04
    
Because I'm using other software that requires 2.2 (it's just part of the job and there's nothing I can do about it). –  Phll Jan 28 at 3:18

1 Answer 1

up vote 2 down vote accepted

Canonical back ports these fixes for Ubuntu. The incident that you found was fixed in 5.3.10-1ubuntu3.2. It appears that the latest version is 5.3.10-1ubuntu3.9. You can go back and look at the change logs for the various releases.

I suggest that you keep your distro up to date. These commands should do it.

sudo apt-get update
sudo apt-get upgrade

If you're brave, cron that. If not, run it frequently to keep your system up to the latest patch level.

share|improve this answer
    
Thanks for this info! –  Phll Jan 29 at 0:04

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.