Cert unveils serious PHP hole

NEWS Researchers have found a serious vulnerability in server scripting software PHP. The open source scripting language could let hackers run random code or even crash the server, according to US-based security research laboratory Cert. Cert said the latest version, PHP4, is vulnerable but also an older version, PHP3 is at risk. Cert warned: "PHP can be installed on a variety of web servers, including Apache, IIS, Caudium, Netscape and iPlanet, OmniHTTPd and others. "Vulnerabilities in the php_mime_split function may allow an intruder to execute arbitrary code with the privileges of the web server." For more information, see
http://security.e-matters.de/advisories/012002.html