A CVE-2012-1823 was assigned to a PHP-CGI flaw that could allow remote attackers to execute arbitrary code by injecting php-cgi command line arguments via specially crafted query string. Refer to bug #818607 for details about this flaw. The released fix for this issue was reported to be incomplete and can be bypassed by prefixing the query string with spaces (e.g. ?+-s). However, that problem only affected configurations where insecure wrapper script similar to the one pointed out in the CVE-2012-1823 reporter's blog post: http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/ http://www.php.net/archive/2012.php#id2012-05-06-1 http://wiki.dreamhost.com/PHP.ini#Create_the_script_wrapper While this problem is not a PHP flaw, it was mitigated in the upstream PHP versions 5.3.13 and 5.4.3 by skipping leading spaces in the query string before performing CVE-2012-1823 check: http://git.php.net/?p=php-src.git;a=commitdiff;h=000e84aa88ce16deabbf61e7086fc8db63ca88aa Red Hat PHP packages updates released to correct the CVE-2012-1823 issue do not include this mitigation. Refer to bug #818607, comment #31 for information on how to correct such unsafe wrapper scripts. Future Red Hat PHP packages updates may include this mitigation.
Mitre CVE description: php-wrapper.fcgi does not properly handle command-line arguments, which allows remote attackers to bypass a protection mechanism in PHP 5.3.12 and 5.4.2 and execute arbitrary code by leveraging improper interaction between the PHP sapi/cgi/cgi_main.c component and a query string beginning with a +- sequence. As mentioned above, this CVE is for insecure wrapper rather than PHP.
(In reply to comment #0) > Red Hat PHP packages updates released to correct the CVE-2012-1823 issue do > not include this mitigation. Refer to bug #818607, comment #31 for > information on how to correct such unsafe wrapper scripts. Future Red Hat > PHP packages updates may include this mitigation. This mitigation is now included in the following PHP packages updates for Red Hat Enterprise Linux 5 and 6, which also address CVE-2012-2336 (bug #820708): https://rhn.redhat.com/errata/RHSA-2012-1045.html https://rhn.redhat.com/errata/RHSA-2012-1046.html https://rhn.redhat.com/errata/RHSA-2012-1047.html
Statement: The mitigation for CVE-2012-2335 is included in the following PHP updates for Red Hat Enterprise Linux 5 and 6, which also address CVE-2012-2336 (BZ#820708): https://rhn.redhat.com/errata/RHSA-2012-1045.html https://rhn.redhat.com/errata/RHSA-2012-1046.html https://rhn.redhat.com/errata/RHSA-2012-1047.html