Our products are not affected by this vulnerabilities.
Resin Pro used by Accel Platform is not affected by the php2shell vulnerability.
The implementation of the PHP execution engine included in it differs from that of the PHP core in which this vulnerability exists.
Caucho's Resin Pro includes a PHP execution engine called "Quercus". Quercus is a custom implementation in Java for running programs written in the PHP language.
The php2shell vulnerability stems from a memory handling issue in the PHP core itself. Because Quercus does not embed or execute the PHP core itself, and based on the publicly disclosed vulnerability details and Quercus's implementation, we have determined that Quercus is not affected by this vulnerability.
The doc/admin, doc/config, and doc/resin-doc directories in Resin Pro contain PHP files, but these are used for the administration interface, configuration support tools, and product documentation.
For settings related to your PHP environment, please check the Resin configuration file "%RESIN_HOME%/conf/resin.properties".
This file controls whether standard PHP functionality and related web interfaces are exposed through the following items.
| Function to check | Name of setting items | Value to disable |
|---|---|---|
| Standard execution process for PHP files (enabled if commented out) | quercus_disable | true |
| Publishing built-in documentation (doc/resin-doc) | resin_doc | false |
| Publishing the admin screen (doc/admin) | web_admin_enable | false |
If your environment also uses PHP implementations such as PHP-FPM on the same server or with an integrated system, please evaluate the impact of this vulnerability on those environments separately.
FAQID:1500