[Full-Disclosure] [USN-66-1] PHP vulnerabilities

From: Martin Pitt (martin.pitt_at_canonical.com)
Date: 01/20/05

Next message: Martin Pitt: "[USN-65-1] Apache utility script vulnerability"

Previous message: Anthony Zboralski: "[Full-Disclosure] Re: [ISN] Book Review: Forensic Discovery"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Date: Thu, 20 Jan 2005 18:29:42 +0100
To: ubuntu-security-announce@lists.ubuntu.com

===========================================================
Ubuntu Security Notice USN-66-1 January 20, 2005
php4 vulnerabilities
http://www.securitytracker.com/alerts/2004/Oct/1011984.html
http://www.securityfocus.com/archive/1/384920
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 4.10 (Warty Warthog)

The following packages are affected:

libapache2-mod-php4
php4-cgi
php4-curl

The problem can be corrected by upgrading the affected package to
version 4:4.3.8-3ubuntu7.3. In general, a standard system upgrade is
sufficient to effect the necessary changes.

Details follow:

FraMe from kernelpanik.org reported that the cURL module does not
respect open_basedir restrictions. As a result, scripts which used
cURL to open files with an user-specified path could read arbitrary
local files outside of the open_basedir directory.

Stefano Di Paola discovered a vulnerability in PHP's shmop_write()
function. Its "offset" parameter was not checked for negative values,
which allowed an attacker to write arbitrary data to arbitrary memory
locations. A script which passed unchecked parameters to
shmop_write() could possibly be exploited to execute arbitrary code
with the privileges of the web server and to bypass safe mode
restrictions.

Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/p/php4/php4_4.3.8-3ubuntu7.3.diff.gz
      Size/MD5: 610960 fe787f903688a67343f674ee02bd00b1
    http://security.ubuntu.com/ubuntu/pool/main/p/php4/php4_4.3.8-3ubuntu7.3.dsc
      Size/MD5: 1624 2ca8c4097c0f65a302340ebd3679e6c8
    http://security.ubuntu.com/ubuntu/pool/main/p/php4/php4_4.3.8.orig.tar.gz
      Size/MD5: 4832570 dd69f8c89281f088eadf4ade3dbd39ee

Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/main/p/php4/php4-dev_4.3.8-3ubuntu7.3_all.deb
      Size/MD5: 331490 e003d55ed3e4b213b179ec30facfe0f3
    http://security.ubuntu.com/ubuntu/pool/universe/p/php4/php4-pear_4.3.8-3ubuntu7.3_all.deb
      Size/MD5: 332580 19eea2d0d5618bfd85a39efef1b812e6

amd64 architecture (Athlon64, Opteron, EM64T Xeon)

i386 architecture (x86 compatible Intel/AMD)

powerpc architecture (Apple Macintosh G3/G4/G5)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

application/pgp-signature attachment: Digital signature

Next message: Martin Pitt: "[USN-65-1] Apache utility script vulnerability"

Previous message: Anthony Zboralski: "[Full-Disclosure] Re: [ISN] Book Review: Forensic Discovery"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Relevant Pages

[USN-66-2] PHP vulnerability
... Ubuntu 4.10 ... The following packages are affected: ... Ubuntu Security Notice USN-66-1 described a circumvention of the ...
(Bugtraq)
[Full-Disclosure] [USN-66-2] PHP vulnerability
... Ubuntu 4.10 ... The following packages are affected: ... Ubuntu Security Notice USN-66-1 described a circumvention of the ...
(Full-Disclosure)
[USN-66-2] PHP vulnerability
... Ubuntu 4.10 ... The following packages are affected: ... Ubuntu Security Notice USN-66-1 described a circumvention of the ...
(Full-Disclosure)
[USN-66-1] PHP vulnerabilities
... Ubuntu 4.10 ... The following packages are affected: ...
(Bugtraq)
[USN-40-1] PHP vulnerabilities
... Ubuntu 4.10 ... The following packages are affected: ... amd64 architecture ...
(Full-Disclosure)