1<?php 2$_SERVER['BASE_PAGE'] = 'releases/4_1_2_win32.php'; 3include_once __DIR__ . '/../include/prepend.inc'; 4site_header("PHP 4.1.2 Windows (Win32) Release Announcement"); 5?> 6 7<h1>PHP 4.1.2 Windows (Win32) Release Announcement</h1> 8 9<p> 10 Due to an issue with the Windows binary allowing any user to read or 11 execute the contents of a file directly from the PHP binary, we have 12 delayed the 4.1.2 release of PHP for Windows to allow for this fix. 13 This release also fixes the file upload security problem. 14</p> 15 16<p> 17 With this new release, we introduce 2 new php.ini settings, which 18 <strong>MUST</strong> be set to make the binary work. It's worth 19 noting, at this point, that this particular fix only applies to 20 the CGI binary. The SAPI module will still work as expected, 21 and it's use is encouraged. 22</p> 23 24<p>The new settings are:</p> 25<ul> 26 <li><code>cgi.force_redirect 0|1</code></li> 27 <li><code>cgi.redirect_status_env ENV_VAR_NAME</code></li> 28</ul> 29 30<h2>WebServers affected by this vulnerability</h2> 31 32<p> 33 It is known that Apache (any version) and iPlanet servers are 34 vulnerable to this issue, however Microsoft IIS is not. Since 35 cgi.force_redirect takes a value of either 1 or 0, (on or off) 36 you should set it to 1 if you are running Apache or iPlanet 37 servers, and to 0 for IIS. If you are unsure of which you need, 38 set it to 1 and see if your scripts execute. You will need to 39 stop and restart your server when you change your php.ini file, 40 for the changes to have effect. 41</p> 42<p> 43 If cgi.force_redirect is turned on, and you are not running under 44 Apache or Netscape (iPlanet) web servers, you MAY need to set an 45 environment variable name that PHP will look for to know it is OK 46 to continue execution. Setting this variable MAY cause security 47 issues, so check what you are doing first. 48</p> 49 50<p> 51 More information can be found <a href="http://security.e-matters.de/advisories/012002.html">here</a> 52 relating to the form upload exploit that caused the release of 4.1.2 initially. 53</p> 54 55<?php site_footer(); ?> 56
