0

I have a web server that needs to pass a PCI compiance scan by ControlScan. Everything is good except for a scan they did of the PHP version. I believe I have the latest version that CentOS provides. Here's what they had to say:

THREAT REFERENCE

Summary: vulnerable PHP version: 5.2.6

Risk: High (3) Port: 80/tcp Protocol: tcp Threat ID: web_prog_php_version

<---REALLY LONG LIST OF PHP Vulnerabilities Trimmed--->

Information From Target: Service: http Sent: GET /javascript/ HTTP/1.0 Host: User-Agent: Mozilla/4.0

Received: X-Powered-By: PHP/5.2.6

Here's my version of php:

rpm -qa php php-5.2.6-1.el5.art

From my understanding, it's backported so although it's not the latest version, it still has security patches applied.

I believe I have the latest version installed that CentOS allows (in fact I just did an update a couple weeks ago) Here's the current output:

yum update php Loaded plugins: fastestmirror Loading mirror speeds from cached hostfile * addons: mirror.es.its.nyu.edu * base: mirror.atlanticmetro.net * extras: mirrors.advancedhosters.com * updates: mirror.linux.duke.edu addons | 1.9 kB 00:00 base | 1.1 kB 00:00 extras | 2.1 kB 00:00 updates | 1.9 kB 00:00 Setting up Update Process No Packages marked for Update

They asked for the changelog, so I ran:

rpm -q --changelog php

but it lists no CVE's.... How can I determine if PHP actually contains these vulnerabilities? I'm at the end of my rope with this... It's frustrating because they're not actually testing vulnerabilities, they're just picking up a version number from the headers... :/

Improve this question
2
  • The 'rpm -q --changelog php' should display any CVE's. Have you tried running it with 'rpm -q --changelog php | grep CVE'? Also, what version of CentOS are you running and have you updated using the default repo's at all?
    – Rex
    Dec 3, 2013 at 19:33
  • 3
    @BlkStormy Dude. You're running PHP 5.2. Sorry to be the one to break it to you but your environment is kinda screwed. It's virtually impossible to pass any kind of audit with something that old (and with that many known problems), and your upgrade/migration path takes you across a bunch of compatibility-breaking changes. I suggest you read through the PHP Changelogs and sit down with your boss to discuss the required work and/or possible compensating controls...
    – voretaq7
    Dec 3, 2013 at 23:14

1 Answer 1

Reset to default
1

It's even worse... You're using an old, and third party PHP package. Who knows if they've ever updated it? It's certainly not likely that they've backported security fixes.

You really should update PHP to the latest available 5.4 or 5.5 version; if you're using the upstream build or a third party build, that's the only way you can really be sure. Which means you should probably also update the OS to the latest available version.

Improve this answer
6
  • I'm curious why you say it's old? I literally just updated it from the repos via yum a couple weeks ago. I realize it's not the latest version of PHP, but doesn't backporting come into play here with RH and CentOS?
    – BlkStormy
    Dec 3, 2013 at 19:52
  • 3
    You got PHP from a third party, not from Red Hat/CentOS. So there's only backporting if that third party is doing it (and you have no way to know). And PHP 5.2.6 was released on May 2008, and is missing thousands of bug fixes...
    – Michael Hampton
    Dec 3, 2013 at 19:56
  • 1
    Not only was it released in May 2008, but it has been unsupported since January 2011. php.net/eol.php
    – ceejayoz
    Dec 3, 2013 at 19:58
  • So, how do I install the official one? I was under the impression that yum automatically pulled that down (forgive my ignorance)
    – BlkStormy
    Dec 3, 2013 at 23:01
  • @BlkStormy see statement Which means you should probably also update the OS to the latest available version.
    – Zoredache
    Dec 3, 2013 at 23:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .