PHP-CGI Vulnerability Exploited in the Wild

Re:PHP-CGI Vulnerability Exploited in the Wild by rickmb on Tuesday May 08, 2012 @01:34PM (#3944828)

"In the wild" in this case was just their honeypots. Actually vulnerable site should be very rare.

Also, one would assume that any website still using php-cgi has plenty of other security vulnerabilities.

[ Parent | on HN ]

Re:PHP-CGI Vulnerability Exploited in the Wild by davedd on Tuesday May 08, 2012 @01:36PM (#3944838)

You would be surprised:

http://www.shodanhq.com/search?q=PHP-CGI

[ Parent | on HN ]

Re:PHP-CGI Vulnerability Exploited in the Wild by chc on Tuesday May 08, 2012 @01:40PM (#3944869)

Just about all the results there appear to be abandoned cPanel placeholders and similar — very few even have domains. I couldn't look at all of them, obviously, but this seems to bear out the idea that nothing anyone cares about is run on PHP-CGI.

[ Parent | on HN ]

Re:PHP-CGI Vulnerability Exploited in the Wild by rickmb on Tuesday May 08, 2012 @02:07PM (#3945033)

The headers suggest ancient, unmaintained systems running outdated, no longer supported software with multiple known vulnerabilities.

I would be surprised if these systems haven't already been p0wned a long time ago.

[ Parent | on HN ]

Re:PHP-CGI Vulnerability Exploited in the Wild by shebson on Tuesday May 08, 2012 @02:22PM (#3945125)

My thought exactly. Anyone who keeps their stack up to date is using the Apache2 Handler or FastCGI. Even if they're still on Apache1, mod_php isn't vulnerable.

[ Parent | on HN ]

Re:PHP-CGI Vulnerability Exploited in the Wild by mike-cardwell on Tuesday May 08, 2012 @02:37PM (#3945205)

If you're serving sites for multiple different users (eg shared hosting) you can't safely use mod_php as all of the php would end up running under the same uid.

I bet there are still tens of thousands of otherwise secure php-cgi setups out there.

[ Parent | on HN ]