The OpenNET Project
 
Search (keywords):  SOFT ARTICLES TIPS & TRICKS SECURITY
LINKS NEWS MAN DOCUMENTATION


[ GLSA 200811-05 ] PHP: Multiple vulnerabilities


<< Previous INDEX Search src / Print Next >>
Date: Sun, 16 Nov 2008 17:08:59 +0100
From: Tobias Heinlein <keytoaster@gentoo.org.>
To: [email protected]
Subject: [ GLSA 200811-05 ] PHP: Multiple vulnerabilities
OpenPGP: id=9CE3CA91
Content-Type: multipart/signed; micalg=pgp-sha1;
 protocol="application/pgp-signature";
 boundary="------------enig338A4785D402A87FE7FA241D"
X-Virus-Scanned: antivirus-gw at tyumen.ru

This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
--------------enig338A4785D402A87FE7FA241D
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 200811-05
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                            http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -


  Severity: Normal
     Title: PHP: Multiple vulnerabilities
      Date: November 16, 2008
      Bugs: #209148, #212211, #215266, #228369, #230575, #234102
        ID: 200811-05

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -


Synopsis
=3D=3D=3D=3D=3D=3D=3D=3D

PHP contains several vulnerabilities including buffer and integer
overflows which could lead to the remote execution of arbitrary code.

Background
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

PHP is a widely-used general-purpose scripting language that is
especially suited for Web development and can be embedded into HTML.

Affected packages
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

    -------------------------------------------------------------------
     Package       /  Vulnerable  /                         Unaffected
    -------------------------------------------------------------------
  1  dev-lang/php     < 5.2.6-r6                           >=3D 5.2.6-r6


Description
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

Several vulnerabilitites were found in PHP:

* PHP ships a vulnerable version of the PCRE library which allows for
  the circumvention of security restrictions or even for remote code
  execution in case of an application which accepts user-supplied
  regular expressions (CVE-2008-0674).


* Multiple crash issues in several PHP functions have been
  discovered.


* Ryan Permeh reported that the init_request_info() function in
  sapi/cgi/cgi_main.c does not properly consider operator precedence
  when calculating the length of PATH_TRANSLATED (CVE-2008-0599).


* An off-by-one error in the metaphone() function may lead to memory
  corruption.


* Maksymilian Arciemowicz of SecurityReason Research reported an
  integer overflow, which is triggerable using printf() and related
  functions (CVE-2008-1384).


* Andrei Nigmatulin reported a stack-based buffer overflow in the
  FastCGI SAPI, which has unknown attack vectors (CVE-2008-2050).


* Stefan Esser reported that PHP does not correctly handle multibyte
  characters inside the escapeshellcmd() function, which is used to
  sanitize user input before its usage in shell commands
  (CVE-2008-2051).


* Stefan Esser reported that a short-coming in PHP's algorithm of
  seeding the random number generator might allow for predictible
  random numbers (CVE-2008-2107, CVE-2008-2108).


* The IMAP extension in PHP uses obsolete c-client API calls making
  it vulnerable to buffer overflows as no bounds checking can be done
  (CVE-2008-2829).


* Tavis Ormandy reported a heap-based buffer overflow in
  pcre_compile.c in the PCRE version shipped by PHP when processing
  user-supplied regular expressions (CVE-2008-2371).


* CzechSec reported that specially crafted font files can lead to an
  overflow in the imageloadfont() function in ext/gd/gd.c, which is
  part of the GD extension (CVE-2008-3658).


* Maksymilian Arciemowicz of SecurityReason Research reported that a
  design error in PHP's stream wrappers allows to circumvent safe_mode
  checks in several filesystem-related PHP functions (CVE-2008-2665,
  CVE-2008-2666).


* Laurent Gaffie discovered a buffer overflow in the internal
  memnstr() function, which is used by the PHP function explode()
  (CVE-2008-3659).


* An error in the FastCGI SAPI when processing a request with
  multiple dots preceding the extension (CVE-2008-3660).


Impact
=3D=3D=3D=3D=3D=3D

These vulnerabilities might allow a remote attacker to execute
arbitrary code, to cause a Denial of Service, to circumvent security
restrictions, to disclose information, and to manipulate files.

Workaround
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

There is no known workaround at this time.

Resolution
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

All PHP users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=3Ddev-lang/php-5.2.6-r6"


References
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

  [ 1 ] CVE-2008-0599
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2008-0599
  [ 2 ] CVE-2008-0674
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2008-0674
  [ 3 ] CVE-2008-1384
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2008-1384
  [ 4 ] CVE-2008-2050
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2008-2050
  [ 5 ] CVE-2008-2051
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2008-2051
  [ 6 ] CVE-2008-2107
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2008-2107
  [ 7 ] CVE-2008-2108
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2008-2108
  [ 8 ] CVE-2008-2371
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2008-2371
  [ 9 ] CVE-2008-2665
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2008-2665
  [ 10 ] CVE-2008-2666
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2008-2666
  [ 11 ] CVE-2008-2829
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2008-2829
  [ 12 ] CVE-2008-3658
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2008-3658
  [ 13 ] CVE-2008-3659
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2008-3659
  [ 14 ] CVE-2008-3660
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2008-3660

Availability
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

  http://security.gentoo.org/glsa/glsa-200811-05.xml

Concerns?
=3D=3D=3D=3D=3D=3D=3D=3D=3D

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
[email protected] or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=3D=3D=3D=3D=3D=3D=3D

Copyright 2008 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5


--------------enig338A4785D402A87FE7FA241D
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.9 (GNU/Linux)

iEYEARECAAYFAkkgRZ8ACgkQD/IBIJzjypEAXwCfSFpzPuhv4EktrZM+B91x7Ff4
p70AnAwT/NcPizd+cwrpp7QJXRN0d0SW
=yqi5
-----END PGP SIGNATURE-----

--------------enig338A4785D402A87FE7FA241D--


<< Previous INDEX Search src / Print Next >>



Партнёры:
PostgresPro
Inferno Solutions
Hosting by Hoster.ru
Хостинг:

Закладки на сайте
Проследить за страницей
Created 1996-2024 by Maxim Chirkov
Добавить, Поддержать, Вебмастеру