[eddie5659]

Hiya



PHP is a cross-platform, server-side, embedded scripting language used in many Web server environments. PHP versions 4.3.6 and earlier for Microsoft Windows operating systems, could allow a remote attacker to execute commands. The escapeshellarg function is used to stop the execution of additional commands, however this function does not work correctly when running on Microsoft Windows operating systems.


Platforms Affected:

Microsoft Corporation: Windows Any version
PHP Group: PHP 4.3.6 and prior


http://xforce.iss.net/xforce/xfdb/16331

Regards

eddie

[john1]

Is this just another vulnerability
over which we have no control ?

Or can the PHPs be dis-abled ?

And what is an additional command ?

[Shadow2531]

In addition, the PHP 4.3.6 win32 apache module broke a few SquirrelMail Plugins. Problems are fixed in PHP 4.3.7. 4.3.6 appears to be quite buggy. I suggest upgrading to 4.3.7.