Release Date: 17 February 2012 Affected Versions: 5.2.0 - 5.2.17 (unsupported version) ------------------------------------------------------------------------------------------ Description: If PHP bails out in startup stage before setting PG(modules_activated) to 1, the filter_globals struct is not cleaned up on shutdown stage. The subsequence request will use uncleaned value in filter_globals struct. With special crafted request, this problem can lead to information disclosure and remote code execution. Only apache modules SAPI are found to vulnerable to this problem. While other SAPIs are safe because a PHP process exits when PHP bails out before setting PG(modules_activated) to 1. This bug was fixed before releasing 5.3.0. http://svn.php.net/viewvc?view=revision&revision=279522. But the patch is not backported to 5.2 version as described in https://bugs.php.net/bug.php?id=47930. ------------------------------------------------------------------------------------------ Solution: Upgrade to 5.3 ------------------------------------------------------------------------------------------ Workaround: If you still need to use PHP 5.2.x, I recommend to use cgi SAPI. If you still need to use PHP 5.2.x as apache module, installing Suhosin patch AND extension should help you. Just only Suhosin patch, it still seems exploitable but much more difficult. ------------------------------------------------------------------------------------------ Vendor Response: The final release of PHP 5.2 was in January 2011. We are not planning any further releases. Worawit Wangwarunyoo
