Yup. That change dates back to PHP 4.4.2, which was released back in January 2006. It's listed at http://php.net/ChangeLog-4.php as "Prevent header injection by limiting each header to a single line."
I'm actually curious about a recent feature addition, in 5.3.4:
"Paths with NULL in them (foo\0bar.txt) are now considered as invalid. (Rasmus)"
If that's really the case, it seems like Rasmus has eliminated a large swath of null byte vulnerabilities in PHP applications (at least those null byte vulnerabilities involving the filesystem, which are the kind I'm used to seeing). I've been meaning to compile 5.3.3 and 5.3.4 locally to test out the different behaviors.
> If that's really the case, it seems like Rasmus has eliminated a large swath of null byte vulnerabilities in PHP applications.
Yes -- this specific change mitigates a lot of simple local file inclusion vulnerabilities. It's not a cure-all, but it does at least prevent many common antipatterns (e.g, include("languages/$_COOKIE['lang'].php")) from being trivially exploited.
I'm actually curious about a recent feature addition, in 5.3.4:
"Paths with NULL in them (foo\0bar.txt) are now considered as invalid. (Rasmus)"
If that's really the case, it seems like Rasmus has eliminated a large swath of null byte vulnerabilities in PHP applications (at least those null byte vulnerabilities involving the filesystem, which are the kind I'm used to seeing). I've been meaning to compile 5.3.3 and 5.3.4 locally to test out the different behaviors.