Re: php vulnerability
Rainer Dorsch <rainer.dorsch@informatik.uni-stuttgart.de> writes:
> Hello,
>
> thanks for the quick reply.
>
> They give a workaround at the web page:
>
> http://CERT.Uni-Stuttgart.DE/ticker/article.php?mid=718
>
> That is what I have in place right now.
You should tell your computer security people, too. ;-)
Debian/unstable now has got PHP 4.1.2 (which fixes the problem
upstream), and a DSA for Debian/timetravel has been released, too. If
you install the packages for potato, you should send us a short
notice, otherwise we might block TCP port 80 traffic to your servers
even if they aren't vulnerable (because we look only at the version
number for determining potentially vulnerable servers).
--
Florian Weimer Weimer@CERT.Uni-Stuttgart.DE
University of Stuttgart http://CERT.Uni-Stuttgart.DE/people/fw/
RUS-CERT +49-711-685-5973/fax +49-711-685-5898
Reply to: