On May 3rd, a PHP-CGI vulnerability termed as “severe” by CloudLinux was published in US CERT web site.

The vulnerability causes any server running PHP as CGI to allow source code disclosure and arbitrary command execution using the account’s privileges. The quote from US CERT web site is below:

When PHP is used in a CGI-based setup (such as Apache’s mod_cgid), the php-cgi receives a processed query string parameter as command line arguments which allows command-line switches, such as -s, -d or -c to be passed to the php-cgi binary, which can be exploited to disclose source code and obtain arbitrary code execution.

While the primary vulnerability was reported for PHP-CGI executions, the CloudLinux note cautioned that this could be applicable to suPHP and mod_fcgid as well. But a post in suPHP mailing list says it is not affected by this vulnerability.

Response from Parallels

Parallels reacted with a 3 point resolution to this issue, as described in their KB entry on CVE-2012-1823.Important points are quoted below:

This is a Critical Vulnerability that affects software that contains PHP-CGI. PHP-FastCGI is not vulnerable to this exploit.
Parallels Plesk for Windows versions 10.4 and earlier are NOT affected.
Parallels Plesk for Linux versions 9.3 – 10.4 are NOT affected by the PHP-CGI remote code execution vulnerability due to use of the special cgi_wrapper script.
Parallels Plesk for Linux versions 8.6 and earlier are NOT affected due to use of mod_php only.
Parallels Plesk for Linux versions 9.0 – 9.2.3 might be vulnerable. Plesk team is working on an update.
1. It’s strongly recommended to update Plesk to the higher version that is not vulnerable.
2. CGI wrapper is the recommended way to workaround the issue, if Plesk update is not possible.
3. It is also possible to workaround the problem with .htaccess rules for each website.

Response from cPanel

A very reassuring post from cPanel says the customers who use EasyApache to compile their web servers are safe. cPanel though cautions that mod_cgi and mod_cgid are not recommended, and should ideally use suPHP. cPanel’s documentation says that suPHP is compiled using paranoid settings, which means that as long as you are using the latest PHP in a cPanel server running suPHP, you should be safe.

Response from CloudLinux

CloudLinux was one of the first to react to this situation, and have released a patch for those servers using PHP from CloudLinux repository. The patch is released in beta state and are awaiting a fully tested solution from RedHat. For the time being, the recommended solution is to upgrade PHP using the cloudlinux-updates-testing repo as quoted below from the CloudLinux blog post.

To deploy on CL5 (php53-5.3.3-5.el5.cloudlinux.1):
# yum update php53 –enablerepo=cloudlinux-updates-testing
To deploy on CL6 (php-5.3.3-3.el6_2.6.cloudlinux.1):
# yum update php –enablerepo=cloudlinux-updates-testing

To update PHP 5.1 on CL5 (php-5.1.6-32.el5.cloudlinux.1)
# yum update php –enablerepo=cloudlinux-updates-testing

So to summarize, if you have cPanel servers with the recommended web server settings you do not have anything to worry about. If you are using mod_cgi or mod_cgid, switch to suPHP, and you will be safe. If you are using Plesk products, upgrade to the latest release. If you have any questions, we would be happy to answer. 🙂

About the Author:

Visakh has been with Bobcares from May 2004, and has extensive experience in administering various control panels and operating systems used in web hosting industry. He is an avid reader, and loves topics on technology, humour and philosophy.