Latest revision as of 18:07, 10 February 2012

[edit] PHP Function popen() allows attacker to execute commands on a system

PHP function popen() allows an attacker to execute shell commands through php. This makes it possible for a PHP application to execute any command on the system, with the priviliges it is running as. A large number of malicious applications use this function to carry about commands on the system, and some application developers do not use thsi function security. Making it possible for an attacker to inject their own commands through the function, even when the web application itself is not-malicious.

[edit] Next Steps

If this risk is unacceptable for your system, then you will want to disable this capability in PHP.

Step 1: Log into the ASL GUI, click on Configuration and select the ASL configuration menu option. This will open the ASL configuration screen.

Step 2: Scroll down to PHP_CHECKS and make sure this is set to "yes". By default ASL will only warn about PHP vulnerabilities. If you set this to yes, it will also fix these vulnerabilities. If this is set to "no" the next step will not work, so set this to "yes".

Step 3: Scroll down to ALLOW_open and set this to "no".

Step 4: Click the "update" button.

This will resolve this vulnerability.