Hacker News

points by 1718627440 14 hours ago | 0 comments

> I am very curious to hear why you thought it was overblown.

Not having made the claim (took down my website too), but because PHP is not connected directly to the network. While you cannot prevent PHP from being overtaken from inside the PHP program, you can prevent PHP being executed on malicious data by configuring the webserver. It's overblown in the sense that it would be even more serious if the same happened in the webserver itself.

[–] cowlevel 14 hours ago

Can you? Initial suggestions to block multipart content-types were a red herring.

[–] 1718627440 13 hours ago

In theory yes. In practice, I don't know, I hope my provider patched it properly.

[–] cowlevel 12 hours ago

What specific configuration would you recommend to block the vulnerability without actually patching it?

[–] kalleboo 2 hours ago

You could configure your web server to only allow one request per worker, which means the corrupted memory can not get used by the attacker. Not great for performance, obviously.

[–] 1718627440 12 hours ago

None. Like I wrote "I don't know, I hope my provider patched it properly."

[–] cowlevel 12 hours ago

Then why did you say

> you can prevent PHP being executed on malicious data by configuring the webserver.

[–] jstanley 12 hours ago

Configure your webserver to not execute PHP code.

[–] 1718627440 11 hours ago

You can do this. I don't know how, and I don't think it's a feasible use of my time, to find out how. It's obviously computable on a Turing machine, because they were able to patch PHP.

[–] cowlevel 11 hours ago

So it was useless advice? You presented it as if anyone not following the advice is incompetent, now you suggest nobody knows how to do it. Is everyone incompetent?

[–] kxrm 10 hours ago

> I don't know how

You are spreading misinformation then.

The configuration change was never a full protection from this vulnerability because the problem is with how PHP processed the request well before the configuration or your PHP code was executed.