[Modsecurity] How to prevent PHP 4.4.x/5.x Vulnerabilities

[Michal Wallace]

On Tue, 18 Apr 2006, Steve West wrote:

> I'm wondering if anyon knows how to prevent some PHP 4.4.x/5.x
> vulnerabilities via mod_security until PHP group releases fixes for
> these. Here is more info on the vulnerabilities:
> 
> PHP copy() function: http://securitytracker.com/alerts/2006/Apr/1015882.html
> PHP tempname() Arg: http://securitytracker.com/alerts/2006/Apr/1015881.html
> PHP crashing Apache: http://securitytracker.com/alerts/2006/Apr/1015880.html

I don't think mod_security is the right tool for filtering these,
since they involve patterns int he PHP code and not in the HTTP
request.

> PHP phpinfo() validation:
> http://securitytracker.com/alerts/2006/Apr/1015879.html

You might be able to write a rule for this one, but you 
can also add phpinfo to your php.ini disable_functions list.
There's an example here:
 
 http://www.netadmintools.com/art411.html

Sincerely,
 
Michal J Wallace
Sabren Enterprises, Inc.
-------------------------------------
contact: michal at sabren.com
hosting: http://www.cornerhost.com/
my site: http://www.withoutane.com/
-------------------------------------