PHP-CGI query string parameter vulnerability

[thunderbird]

Is Synology's implementation of PHP vulnerable to this?
http://www.kb.cert.org/vuls/id/520827

[CoolRaoul]

Although Apache module "mod_cgid" is available in DSM apache:

Code: Select all

$ ls -l /usr/syno/apache/modules/mod_cgid.so
-rwxr-xr-x 1 root root 25060 2012-04-12 23:26 /usr/syno/apache/modules/mod_cgid.so


It is not loaded by default in the current (DSM 4.0) implementation.

So unless you've manually edited your Apache configuration to explicitely load it with a line like this one:

Code: Select all

LoadModule cgid_module modules/mod_cgid.so

you are not vulnerable