CVE-2012-2311

Published: 4 May 2012

sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does not properly handle query strings that contain a %3D sequence but no = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1823.

From the Ubuntu Security Team

It was discovered that PHP, when used as a stand alone CGI processor for the Apache Web Server, did not properly parse and filter query strings. This could allow a remote attacker to execute arbitrary code running with the privilege of the web server. Configurations using mod_php5 and FastCGI were not vulnerable.

Notes

Please see http://www.php.net/archive/2012.php#id2012-05-06-1 for
more details when using configurations other than as described in
/usr/share/doc/php5-cgi/README.Debian.gz.

Mitigation

The php-security.net article has an updated set of mod_rewrite rules that
can mitigate the vulnerability as well:
  RewriteEngine on
  RewriteCond %{QUERY_STRING} ^[^=]*$
  RewriteCond %{QUERY_STRING} %2d|\- [NC]
  RewriteRule .? - [F,L]

Status

References

• http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/
• http://www.php-security.net/archives/11-Mitigation-for-CVE-2012-1823-CVE-2012-2311.html
• https://ubuntu.com/security/notices/USN-1437-1
• http://www.php.net/archive/2012.php#id2012-05-06-1
• https://www.cve.org/CVERecord?id=CVE-2012-2311
• NVD
• Launchpad
• Debian

Bugs

• https://bugs.php.net/bug.php?id=61910