[OpenPKG-SA-2007.010] OpenPKG Security Advisory (php)



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

____________________________________________________________________________

Publisher Name: OpenPKG GmbH
Publisher Home: http://openpkg.com/

Advisory Id (public): OpenPKG-SA-2007.010
Advisory Type: OpenPKG Security Advisory (SA)
Advisory Directory: http://openpkg.com/go/OpenPKG-SA
Advisory Document: http://openpkg.com/go/OpenPKG-SA-2007.010
Advisory Published: 2007-02-23 17:21 UTC

Issue Id (internal): OpenPKG-SI-20070211.02
Issue First Created: 2007-02-11
Issue Last Modified: 2007-02-23
Issue Revision: 11
____________________________________________________________________________

Subject Name: php
Subject Summary: Programming Language
Subject Home: http://www.php.net/
Subject Versions: * <= 5.2.0

Vulnerability Id: CVE-2006-6383, CVE-2007-0905, CVE-2007-0906,
CVE-2007-0907, CVE-2007-0908, CVE-2007-0909,
CVE-2007-0910, CVE-2007-0988
Vulnerability Scope: global (not OpenPKG specific)

Attack Feasibility: run-time
Attack Vector: local system, remote network
Attack Impact: denial of service, exposure of sensitive
information, manipulation of data, arbitrary code
execution

Description:
According to a vendor release announcement [0], multiple
vulnerabilities exist in the programming language PHP [1], version
up to and including 5.2.0.

PHP 5.2.0 and 4.4 allows local users to bypass safe_mode and
open_basedir restrictions via a malicious path and a null byte
before a ";" in a session_save_path argument, followed by an allowed
path, which causes a parsing inconsistency in which PHP validates
the allowed path but sets session.save_path to the malicious path.
(CVE-2007-0905; possibly duplicate of CVE-2006-6383)

Multiple buffer overflows in PHP before 5.2.1 allow attackers to
cause a denial of service and possibly execute arbitrary code via
unspecified vectors in the session, imap and sqlite extensions; and
the str_replace function.
(CVE-2007-0906)

Buffer underflow in PHP before 5.2.1 allows attackers to cause
a denial of service via unspecified vectors involving the
sapi_header_op function.
(CVE-2007-0907)

The wddx extension in PHP before 5.2.1 allows remote attackers
to obtain sensitive information via unspecified vectors.
(CVE-2007-0908)

Multiple format string vulnerabilities in PHP before 5.2.1 might
allow attackers to execute arbitrary code via format string
specifiers to all of the *print functions on 64-bit systems, and the
odbc_result_all function.
(CVE-2007-0909)

Unspecified vulnerability PHP before 5.2.1 allows attackers to
"clobber" certain super-global variables via unspecified vectors.
(CVE-2007-0910)

If unserializing untrusted data on 64-bit platforms the
zend_hash_init() function can be forced to enter an infinite loop,
consuming CPU resources, for a limited length of time, until the
script timeout alarm aborts the script.
(CVE-2007-0988)

References:
[0] http://www.php.net/releases/5_2_1.php
[1] http://www.php.net/
____________________________________________________________________________

Primary Package Name: php
Primary Package Home: http://openpkg.org/go/package/php

Corrected Distribution: Corrected Branch: Corrected Package:
OpenPKG Enterprise E1.0-SOLID apache-1.3.37-E1.0.2
OpenPKG Enterprise E1.0-SOLID php-5.1.6-E1.0.2
OpenPKG Community 2-STABLE-20061018 apache-1.3.37-2.20070211
OpenPKG Community 2-STABLE-20061018 php-5.2.1-2.20070211
OpenPKG Community 2-STABLE apache-1.3.37-2.20070211
OpenPKG Community 2-STABLE php-5.2.1-2.20070211
OpenPKG Community CURRENT apache-1.3.37-20070208
OpenPKG Community CURRENT php-5.2.1-20070208
____________________________________________________________________________

For security reasons, this document was digitally signed with the
OpenPGP public key of the OpenPKG GmbH (public key id 61B7AE34)
which you can download from http://openpkg.com/openpkg.com.pgp
or retrieve from the OpenPGP keyserver at hkp://pgp.openpkg.org/.
Follow the instructions at http://openpkg.com/security/signatures/
for more details on how to verify the integrity of this document.
____________________________________________________________________________

-----BEGIN PGP SIGNATURE-----
Comment: OpenPKG GmbH <http://openpkg.com/>

iD8DBQFF3xStZwQuyWG3rjQRAvZFAKCmEDPxVoc7iuari942F+vlwYrOkACgmne6
5JbbNEDrNBJO9CXHJ6ZLTdI=
=69CJ
-----END PGP SIGNATURE-----



Relevant Pages

  • [Full-disclosure] [ MDVSA-2009:324 ] php
    ... Package: php ... Multiple vulnerabilities was discovered and corrected in php: ... before 5.2.9 allows remote attackers to cause a denial of service ... Unspecified vulnerability in PHP before 5.2.11 has unknown impact ...
    (Full-Disclosure)
  • [ MDVSA-2009:324 ] php
    ... Package: php ... Multiple vulnerabilities was discovered and corrected in php: ... before 5.2.9 allows remote attackers to cause a denial of service ... Unspecified vulnerability in PHP before 5.2.11 has unknown impact ...
    (Bugtraq)
  • [Full-disclosure] [OpenPKG-SA-2007.010] OpenPKG Security Advisory (php)
    ... vulnerabilities exist in the programming language PHP, ... Multiple buffer overflows in PHP before 5.2.1 allow attackers to ... a denial of service via unspecified vectors involving the ... Unspecified vulnerability PHP before 5.2.1 allows attackers to ...
    (Full-Disclosure)
  • [Full-disclosure] CVE-2008-5557 - PHP mbstring buffer overflow vulnerability
    ... CVE-2008-5557 - PHP mbstring buffer overflow vulnerability ... 4.3.0 and later versions including PHP 5 ... A heap buffer overflow was found in mbstring extension that is ... The vulnerability occurs in the part of the encoding conversion facility ...
    (Full-Disclosure)
  • [Full-disclosure] [ MDVSA-2009:023 ] php
    ... A vulnerability in PHP allowed context-dependent attackers to cause ... The updated packages have been patched to correct these issues. ...
    (Full-Disclosure)