| View previous topic :: View next topic |
| Author |
Message |
spottraining
n00b
Joined: 30 Jan 2005
Posts: 73
Location: Estonia
|
 Posted: Mon Nov 07, 2005 5:52 pm Post subject: php version and new virus Lupper |
 |
|
Hello
I find from news information about new virus called Lupper. So I think to check, is my server OK.
How I know - I have installled latest php and mod_php. But when I look to phpinfo, then its shows PHP Version 4.4.0-gentoo-r1. But emerge search php gives me outbut:
| Code: | dev-php/php
Latest version available: 4.4.0-r4
Latest version installed: 4.4.0-r4
Size of downloaded files: 4,372 kB
Homepage: http://www.php.net/
Description: PHP Shell Interpreter
License: PHP-3
dev-php/mod_php
Latest version available: 4.4.0-r9
Latest version installed: 4.4.0-r9
Size of downloaded files: 4,372 kB
Homepage: http://www.php.net/
Description: Apache module for PHP
License: PHP-3
|
Apache is restarted after update.
Its this normal, that its shows PHP Version 4.4.0-gentoo-r1? The build date is right this, when I have updated my system.
And also - how I can be sure, that my server is not under risk? Php running in default mode.
_________________
Sorry about bad English - I am learning....
The box said Windows XP or better, so I installed Linux |
|
| Back to top |
|
 |
hanj
Veteran
Joined: 19 Aug 2003
Posts: 1500
|
| Posted: Mon Nov 07, 2005 6:08 pm Post subject: |
|
|
I can confirm that I get the same thing.
| Code: | phpinfo()
PHP Version 4.4.0-gentoo-r1 |
| Code: | | [ebuild R ] dev-php/mod_php-4.4.0-r9 |
hanji |
|
| Back to top |
|
|
F.Ultra
Apprentice
Joined: 17 Mar 2004
Posts: 169
Location: Sweden
|
|
| Back to top |
|
|
spottraining
n00b
Joined: 30 Jan 2005
Posts: 73
Location: Estonia
|
| Posted: Mon Nov 07, 2005 6:28 pm Post subject: |
|
|
OK
These packets are not installed
_________________
Sorry about bad English - I am learning....
The box said Windows XP or better, so I installed Linux |
|
| Back to top |
|
|
llongi
Retired Dev
Joined: 15 Apr 2004
Posts: 459
Location: Switzerland
|
| Posted: Mon Nov 07, 2005 6:44 pm Post subject: |
|
|
The -gentoo-r1 is correct (it now is -pl1-gentoo, but that doesn't change much). Anyway, mod_php-4.4.0-r9 has all the security fixes, but from what I've read on that site on this worm, none of those will help, since it exploits bugs in web-applications, not in PHP itself, so also if you have the latest PHP version but use the Drupal from 1 year ago the worm will probably work... 
| Quote: | | and is configured to permit external shell commands and remote file download in the PHP/CGI environment, a copy of the worm could be downloaded and executed. |
Many of those worms and exploits can be prevented or limited by just turning safe_mode to ON, register_globals to OFF, allow_url_fopen to OFF and disable functions such as shell_exec, exec, system etc., this _will_ break some scripts and stuff, but what is coded to work only with those settings is either really special and you know exactly why and who and where this was made, and for what, or it's broken code that should get fixed.
_________________
Best regards, Luca. |
|
| Back to top |
|
|
spottraining
n00b
Joined: 30 Jan 2005
Posts: 73
Location: Estonia
|
| Posted: Mon Nov 07, 2005 7:09 pm Post subject: |
|
|
| CHTEKK wrote: |
Many of those worms and exploits can be prevented or limited by just turning safe_mode to ON, register_globals to OFF, allow_url_fopen to OFF and disable functions such as shell_exec, exec, system etc., this _will_ break some scripts and stuff, but what is coded to work only with those settings is either really special and you know exactly why and who and where this was made, and for what, or it's broken code that should get fixed. |
I dont find these functions like shell_exec and exec from my php.ini file 
Its this normal?
I yust want to be sure, that there is no risk to my server, when some one installing to old CMS.
_________________
Sorry about bad English - I am learning....
The box said Windows XP or better, so I installed Linux |
|
| Back to top |
|
|
hanj
Veteran
Joined: 19 Aug 2003
Posts: 1500
|
| Posted: Mon Nov 07, 2005 7:27 pm Post subject: |
|
|
You need to disable them in php.ini
find:
| Code: | | disable_functions = |
And change it to
| Code: | | disable_functions = shell_exec, exec, etc |
hanji |
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
Networking & Security
