Developers: PHP Vulnerabilities Announced

[sfoma]

From Slashdot -

Posted by michael on Friday December 17, @12:20PM
from the rated-o-for-overtime dept.
Simone Klassen writes "The Hardened-PHP Project has announced several serious and according to them, easy-to-exploit vulnerabilities within PHP. A flaw within the function unserialize() is rated as very critical for millions of PHP servers, because it is exposed to remote attackers through lots of very popular webapplications. The list includes forum software like phpBB2, WBB2, Invision Board and vBulletin. It is time to upgrade now."

[sdjl]

That gives no detail as to what versions of PHP are affected, if any.

[sfoma]

for version information please see the alerts on http://www.php.net/

[sdjl]

I should imagine cPanel will make an upgrade available very shortly

[anguz]

That gives no detail as to what versions of PHP are affected, if any.

Earlier than 4.3.10 or 5.0.3.

The list includes forum software like phpBB2, WBB2, Invision Board and vBulletin. It is time to upgrade now.

In SMF we already put out a fix for the vulnerability.

http://www.simplemachines.org/community/index.php?topic=22008.0

[oarenj]

So we cannot fix this issue ourselves, we have to wait for Andrew to do it? Any time frame? Hours, weeks, days, never?

I have upgraded to the newest phpBB, but one of my sites keeps getting infected - I have to restore the board every hour or so. Which makes for some pretty upset folks..

If there is a way we can fix this ourselves, like update PHP ourselves - PLEASE let us know!

[-Oz-]

I just killed the forums because of this.

[ChrisTech]

So we cannot fix this issue ourselves, we have to wait for Andrew to do it? Any time frame? Hours, weeks, days, never?

I have upgraded to the newest phpBB, but one of my sites keeps getting infected - I have to restore the board every hour or so. Which makes for some pretty upset folks..

If there is a way we can fix this ourselves, like update PHP ourselves - PLEASE let us know!

Check the Annoucement section

http://forums.dathorn.com/showthread.php?p=7309#post7309

[anguz]

Check the Annoucement section
http://forums.dathorn.com/showthread...=7309#post7309

Very cool. I noticed he also updated Zend Optimizer, many other hosts didn't and had to be told.

[AndrewT]

Yes, ZendOptimizer was ugpraded to 2.5.7 as well. This actually came to our attention when we first upgraded to cpanel04 - if this is not done there are many scripts that will have problems.

[anguz]

Yes, ZendOptimizer was ugpraded to 2.5.7 as well. This actually came to our attention when we first upgraded to cpanel04 - if this is not done there are many scripts that will have problems.

Indeed. Thank you very much for always being on the ball.