HTTP: PHP 'php-cgi' Command Line Attribute Remote Code Execution

This signature detects attempts to exploit a known flaw in the PHP Common Gateway Interface (PHP-CGI). A successful attack could result in arbitrary code execution with the permissions of the web server process. This issue is currently being actively exploited in the wild by malicious users. Patches are available.

Extended Description

PHP is prone to an information-disclosure vulnerability. Exploiting this issue allows remote attackers to view the source code of files in the context of the server process. This may allow the attacker to obtain sensitive information and to run arbitrary PHP code on the affected computer; other attacks are also possible.

Affected Products

Avaya aura_messaging

References

BugTraq: 53388

CVE: CVE-2012-2311

URL: http://www.kb.cert.org/vuls/id/520827 http://www.php.net/archive/2012.php#id2012-05-08-1 http://www.php.net/archive/2012.php#id2012-05-03-1 http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/ http://kb.parallels.com/en/116241

Short Name

HTTP:PHP:PHP-CGI-CMD-LINE-RCE

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: PHP 'php-cgi' Command Line Attribute Remote Code Execution

Extended Description

Affected Products

References

Found a potential security threat?