This morning, we returned to Infocon Green. As usual, we are raising the Infocon to alert you to emerging situations requiring immediate attention. PHP fit that description. By now, you either know about it, or you probably never will, so it is time to go back to "business as usual".

 Many vendors have released patches for the vulnerability in sync with PHP.net, showing that the coordinated vulnerability disclosure worked and achieved its goal of providing tested and working patches in a timely manner. Some vendor(s) not playing by the rules and leaking details early is unfortunate but should not overshadow the overall success of providing the patches.

At this point, no reliable exploit has been made available publicly as far as I know. Several firms stated that they possess working exploit code, and I consider it a matter of time before such code becomes publicly available, at which point we will likely see more widespread exploitation. Cloudflare and Amazon have stated that they are seeing a large number of exploit attempts, but it is not clear if these are actual working exploits.

Applying the patch remains your best and only reliable defense. Treat the time you have now as a gift and use it wisely to find and patch applications in your organization.

If you are not able to upgrade, do your best to isolate vulnerable applications. There are various workarounds, but none are considered 100% effective. They may buy you more time. The same is true for web application firewall rules.

Today, php.net advised keeping the "session.upload_progress.enabled=0" workaround in place until the next update. In other words: We are not done patching PHP yet!

As so often, embedded devices and appliances are a major concern, and many of them have not been updated or are unlikely to ever receive a patch. These types of devices should be isolated regardless. The PHP issue is likely just one of many weaknesses that could be exploited. Router admin interfaces, network storage devices, cameras, cat feeding stations, and refrigerators should not be exposed to the internet, and should be isolated on internal networks. At this point, this is table stakes regardless if they are running PHP.

This vulnerability is also a good "dress rehearsal" of what is likely going to come. Vulnerability disclosure worked in this case. Patches were available. There will likely be many more vulnerabilities of similar severity that will be released and exploited with less responsibility. Be ready, run your tabletop exercises, update your inventories... 

Many partial exploits have been released. Be careful; some of them may be "parasitic," trying to exploit whoever runs them. It may be hard to even identify the working exploit once it comes out.

The vulnerability and the risk are real, even if we did not see immediate mass exploitation. That part is still to come; it is just delayed. Just like we lower our infocon, make sure to rest and disconnect a bit, and do not stay "on alert" for too long. You will need the strength for the next issue. And do not overlook other issues that may have been missed this week: Node.js, Fortinet ... and more

--
Johannes B. Ullrich, Ph.D. , Dean of Research, SANS.edu
Twitter|