0

I have web server which response to HEAD / request the following response:

HTTP/1.1 200 OK Server: Apache/2.4.7 (Ubuntu) X-Powered-By: PHP/5.5.9-1ubuntu4.26 ....

Is it possible to know what is the Ubuntu version using those HTTP response headers (Apache/PHP version)?

Improve this question
3
  • There's no such Ubuntu version as 4.25 (their numbering scheme works very differently, unless that's some kind of internal version number). So on the face of it I'd say no. Commented Mar 7, 2022 at 14:16
  • 1
    Why do you need to know? If you're bothered about giving away potentially sensitive info via this header, then simply reconfigure the webserver so it doesn't send out the x-powered-by header. Especially since your PHP version is miles out of date and urgently needs upgrading to a supported version. It's almost begging to be attacked. Commented Mar 7, 2022 at 14:17
  • The 4.26 is a minor version of the ubuntu PHP package. launchpad.net/ubuntu/+source/php5/+changelog shows the changelog with the smaller version numbers. But I agree, you don't really want to expose that information in the headers. Commented Mar 7, 2022 at 14:21

1 Answer 1

Reset to default
3

"5.5.9-1ubuntu4.26" is the version of the PHP package that is installed. The Debian/Ubuntu version labelling scheme is complicated, and I'm not sure of the details, but it's basically "PHP version 5.5.9, Debian/Ubuntu package version 1 / 4.26".

Firstly, note that this is much more valuable to an attacker than knowing the base OS version - if that isn't the latest patch, they can know immediately which security vulnerabilities you will still be vulnerable to.

Secondly, while I don't know offhand the most efficient way to search, all package versions are listed on https://launchpad.net/ along with the Ubuntu versions they are compatible with. It's possible that same package version can be installed on multiple base OSes, but it would certainly be possible to narrow it down to a list of candidates.

Thirdly, PHP 5.5 is now extremely old - it's last official patch was 5 and a half years ago - and it's possible there are security issues in it for which fixes are not easy to apply in the Debian/Ubuntu patches. So revealing that you're running that version, regardless of patch version, might well be useful information to an attacker.

The fix is incredibly simple: PHP has a setting called expose_php. Set this to Off and the X-Powered-By header will be removed completely.

Improve this answer
Sign up to request clarification or add additional context in comments.

Comments

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.