Re: WordPress 2.8.5 Unrestricted File Upload Arbitrary PHP Code Execution



Hi,
Just wanted to add a quick update on affected systems since I forgot to mention webservers along with wordpress versions in my advisory.
Some people are wondering why the vulnerability doesn't work on their system.

I'm pretty sure that the exploit won't work on web servers other than Apache (as they probably won't process extensions other than the last one). So not apache based servers are probably safe here.
Whether it will work on your Apache server or not depends on your mod_php configuration.
The exploit won't work on servers where PHP scripts handling has been configured as follows:

<FilesMatch \.php$>
SetHandler application/x-httpd-php
</FilesMatch>

If the exploit doesn't work for you this is most likely the case.

The exploit however will work on systems where php scripts are handled via the following setting in the php.conf:

AddHandler php5-script .php

which I think is quite common. For example Apache distributed in Red Hat based systems seem to have php configured in such a way.

Hope this clears the matter a bit.

Regards,
Dawid



Relevant Pages

  • RE: Anyone????? FW: Concept Virus(CV) V.5 - Quick analysis updat e
    ... following configuration to Apache will reduce the impact on the servers. ... have been doing this for some time on the production servers that I manage. ... With the "mitigation" configuration: ... The above was tested with the standard Apache "404" error. ...
    (Incidents)
  • RE: Anyone????? FW: Concept Virus(CV) V.5 - Quick analysis updat e
    ... following configuration to Apache will reduce the impact on the servers. ... have been doing this for some time on the production servers that I manage. ... With the "mitigation" configuration: ... The above was tested with the standard Apache "404" error. ...
    (Vuln-Dev)
  • Re: Include with strange phenomena...
    ... > I developed a suite of php scripts and i've tested it with PHP 4.3.3 and ... > Apache; obiouvsly all works fine. ... Any configuration that I forget? ...
    (comp.lang.php)
  • apache balancing with mod_proxy_balancer
    ... and another apache that balances over the two apache service servers. ... configuration is "primary server and a secondary ". ...
    (RedHat)