Unbelievable, why do you set your cgi-binary in the document root tree!?

See http://www.cert.org/advisories/CA-1996-11.html

Actually, our documentation tells win32 users to install that way. I'm investigating a better method right now, and will patch the documentation in a short while.

I knew i forgot to do something after i updated my win32 last week!

Georg, our security section has a link to that CERT
advisory for quite a long time now. I have added a
warning and a link to the particular security page
to that setup instruction page for Apache windows.

Please give better instructions for CGI setups
under windows if you can. A setup, where PHP
sritps are portable, so no #!c:\php\php.exe type
of method is doable...

Maybe James can find another way. The Apache doc
only documents the methods we have in the install
and security chapters...

---
Goba

Ok, 

I have checked in a newer, cleaner version of the relevant documentation. 

As far as the guidelines go, configuring php and apache like that is a massive security risk, (since we've been recommending all production level sites to create a script alias for /php/ and mapping that to their php directory), so I appeal to the apache people (Jimw, etc) to look into ways of fixing it so you don't have to use a scriptalias and action. (or use action with an absolute path).

This is a pretty urgent problem, so i'm going to mark this bug as critical and move it to Apache Related.

As said by others, this is NOT a bug, but a documentation problem.
(btw: assigned to only needs your username)

the documentation is fixed, i committed this morning/last night.

there is however a bug in the way apache handles the binary -- or the way php acts when called as a binary (you can get premature end of script headers).

What i would like to do is leave this open, and noticeable for some of the apache guys to take a look at and comment on it. 

The docs are fixed.... we just need to wait to see if this is a thing to hand off to apache.

so do we have to read the documentation again on how to install PHP?? have u added a fix?

I have windows xp + apache + php 4.1 installed and the /php/ alias is also definied in my httpd.conf and therefor I am also affected by this exploit. but how can I use php WITHOUT this alias in apache conf? I tried several things but it doesn't work.

chris, 15 =)

For emmergency, a simple check at "auto_prepend_file"  whould help:

<?PHP
if (preg_match("/^\/php\/php.exe/i",$_SERVER["REQUEST_URI"])) {
print "No Hack"; exit;
}
?>

we have a manual chapter for securing the cgi-bin installation.
http://www.php.net/manual/en/security.cgi-bin.php

I had someone trying to exploit this bug like two months ago. I accidently saw it in my apache logs someone was trying to do this.

This only happens if you php dir is in your webserver root?