We recently received this from a security audit:
PHP is a general purpose scripting language that can be embedded into HTML. A vulnerability exists in PHP versions prior to 5.3.12 and 5.4.2 due to improper parsing of query string parameters when configured with a CGI-based setup (e.g., Apache's mod_cgid). Processed query string parameters supplied to an arbitrary PHP file are improperly parsed as command line arguments. Remote attackers could leverage this issue to pass command-line switches (e.g., -s, -c, -n, -f, -r, -B, -R, -F, -E, -t, etc.) to the php-cgi binary and disclose potentially sensitive source code information or execute arbitrary code on vulnerable systems with the privileges of the web server. Successful exploitation requires that the HTTP server complies with section 4.4 (The Script Command Line) of The Common Gateway Interface (CGI) Request for Comments (RFC 3875).
We have multiple PHP environments, all running as CGI/Fast CGI under IIS. Updating all the PHP versions is of course the ideal long-term solution. However, that will take some time, testing, and planning. Some of the servers are managed by external hosts we contract with, which will further complicate version upgrades.
How can I check specific environments for this vulnerability? Is there a way to prevent remote attackers from exploiting this without a full version upgrade?