From: marcdeslauriers at videotron.ca (Marc Deslauriers)
Subject: [FLSA-2004:1868] Updated php packages fix security issues

-----------------------------------------------------------------------
               Fedora Legacy Update Advisory

Synopsis:          Updated php packages fix security issues
Advisory ID:       FLSA:1868
Issue date:        2004-10-07
Product:           Red Hat Linux
Keywords:          Bugfix
Cross references:  https://bugzilla.fedora.us/show_bug.cgi?id=1868
CVE Names:         CAN-2004-0594 CAN-2004-0595
-----------------------------------------------------------------------


-----------------------------------------------------------------------
1. Topic:

Updated php packages that fix various security issues are now available.

PHP is an HTML-embedded scripting language commonly used with the Apache
HTTP server.

2. Relevant releases/architectures:

Red Hat Linux 7.3 - i386
Red Hat Linux 9 - i386

3. Problem description:

Stefan Esser discovered a flaw when memory_limit is enabled in versions
of PHP 4 before 4.3.8. If a remote attacker could force the PHP
interpreter to allocate more memory than the memory_limit setting before
script execution begins, then the attacker may be able to supply the
contents of a PHP hash table remotely. This hash table could then be
used to execute arbitrary code as the 'apache' user. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the
name CAN-2004-0594 to this issue.

This issue has a higher risk when PHP is running on an instance of
Apache which is vulnerable to CAN-2004-0493. It may also be possible to
exploit this issue if using a non-default PHP configuration with the
"register_defaults" setting is changed to "On".

Stefan Esser discovered a flaw in the strip_tags function in versions of
PHP before 4.3.8. The strip_tags function is commonly used by PHP
scripts to prevent Cross-Site-Scripting attacks by removing HTML tags
from user-supplied form data. By embedding NUL bytes into form data,
HTML tags can in some cases be passed intact through the strip_tags
function, which may allow a Cross-Site-Scripting attack. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the
name CAN-2004-0595 to this issue.

All users of PHP are advised to upgrade to these updated packages, which
contain backported patches that address these issues.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade.  Only those
RPMs which are currently installed will be updated.  Those RPMs which
are not installed but included in the list will not be updated.  Note
that you can also use wildcards (*.rpm) if your current directory *only*
contains the desired RPMs.

Please note that this update is also available via yum and apt.  Many
people find this an easier way to apply updates.  To use yum issue:

yum update

or to use apt:

apt-get update; apt-get upgrade

This will start an interactive process that will result in the
appropriate RPMs being upgraded on your system.  This assumes that you
have yum or apt-get configured for obtaining Fedora Legacy content.
Please visit http://www fedoralegacy.org/docs for directions on how to
configure yum and apt-get.

5. Bug IDs fixed:

http://bugzilla.fedora.us - 1868 - CAN-2004-0594, 0595 - PHP multiple
vulnerabilities

6. RPMs required:

Red Hat Linux 7.3:

SRPM:
http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/php-4.1.2-7.3.10.legacy.src.rpm

i386:
http://download.fedoralegacy.org/redhat/7.3/updates/i386/php-4.1.2-7.3.10.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/7.3/updates/i386/php-devel-4.1.2-7.3.10.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/7.3/updates/i386/php-imap-4.1.2-7.3.10.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/7.3/updates/i386/php-ldap-4.1.2-7.3.10.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/7.3/updates/i386/php-manual-4.1.2-7.3.10.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/7.3/updates/i386/php-mysql-4.1.2-7.3.10.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/7.3/updates/i386/php-odbc-4.1.2-7.3.10.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/7.3/updates/i386/php-pgsql-4.1.2-7.3.10.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/7.3/updates/i386/php-snmp-4.1.2-7.3.10.legacy.i386.rpm

Red Hat Linux 9:

SRPM:
http://download.fedoralegacy.org/redhat/9/updates/SRPMS/php-4.2.2-17.7.legacy.src.rpm

i386:
http://download.fedoralegacy.org/redhat/9/updates/i386/php-4.2.2-17.7.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/9/updates/i386/php-devel-4.2.2-17.7.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/9/updates/i386/php-imap-4.2.2-17.7.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/9/updates/i386/php-ldap-4.2.2-17.7.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/9/updates/i386/php-manual-4.2.2-17.7.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/9/updates/i386/php-mysql-4.2.2-17.7.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/9/updates/i386/php-odbc-4.2.2-17.7.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/9/updates/i386/php-pgsql-4.2.2-17.7.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/9/updates/i386/php-snmp-4.2.2-17.7.legacy.i386.rpm

7. Verification:

SHA1 sum                                 Package Name
---------------------------------------------------------------------------

6aaefdbf687f8dbf9ffc7b2ab0a0ff2914a13028 
redhat/7.3/updates/i386/php-4.1.2-7.3.10.legacy.i386.rpm
3f38e8929822edc377f61a05c31e45c8599a4ba6 
redhat/7.3/updates/i386/php-devel-4.1.2-7.3.10.legacy.i386.rpm
8c9ac5e7c5040b2d9cf75848acc1260842a5e4aa 
redhat/7.3/updates/i386/php-imap-4.1.2-7.3.10.legacy.i386.rpm
d01be5026d335032486eee9f91fdc72e43d78f54 
redhat/7.3/updates/i386/php-ldap-4.1.2-7.3.10.legacy.i386.rpm
20ed3b170959f47061fbf688bd0bf6c2380cee6c 
redhat/7.3/updates/i386/php-manual-4.1.2-7.3.10.legacy.i386.rpm
66413adf5bf185326ea1658d837bbd34a4c2e59b 
redhat/7.3/updates/i386/php-mysql-4.1.2-7.3.10.legacy.i386.rpm
5fd105b2b8e9aea72d4e34f4800218b40fe844b9 
redhat/7.3/updates/i386/php-odbc-4.1.2-7.3.10.legacy.i386.rpm
3c9152d075afc06ffb2ac64deeca3b331f3a6c06 
redhat/7.3/updates/i386/php-pgsql-4.1.2-7.3.10.legacy.i386.rpm
58027e3f2bd1485bae158cf99aebc63b631972ec 
redhat/7.3/updates/i386/php-snmp-4.1.2-7.3.10.legacy.i386.rpm
bd2e823603fab8b75a17647ac396263cc1ad6d7e 
redhat/7.3/updates/SRPMS/php-4.1.2-7.3.10.legacy.src.rpm
594a4c87bf2b073b681b1c94a7bcf7ee7d5bc0dd 
redhat/9/updates/i386/php-4.2.2-17.7.legacy.i386.rpm
e1f076f96cfce7d687ad67f26f5e1c33f5993270 
redhat/9/updates/i386/php-devel-4.2.2-17.7.legacy.i386.rpm
d349ace9d0a8514cd563217d56ef1f25261f2c92 
redhat/9/updates/i386/php-imap-4.2.2-17.7.legacy.i386.rpm
176e15f14ec6045aefd9c924dfa383c58598e16d 
redhat/9/updates/i386/php-ldap-4.2.2-17.7.legacy.i386.rpm
a6cda124e7a2de4083bec0a78f6758ab9f36a374 
redhat/9/updates/i386/php-manual-4.2.2-17.7.legacy.i386.rpm
42a87a54e0502721eec4907a8cb1c8db196c442a 
redhat/9/updates/i386/php-mysql-4.2.2-17.7.legacy.i386.rpm
117bc0f478babf8317812fc35c763e8afeccca49 
redhat/9/updates/i386/php-odbc-4.2.2-17.7.legacy.i386.rpm
c52bb318d8b217c02b61bd277f662a483e05e61b 
redhat/9/updates/i386/php-pgsql-4.2.2-17.7.legacy.i386.rpm
6ec57d0958666d97532099d7f1118a52727db02b 
redhat/9/updates/i386/php-snmp-4.2.2-17.7.legacy.i386.rpm
40e6bb2279a9154ecf0c313c39ab563c6de5a8ad 
redhat/9/updates/SRPMS/php-4.2.2-17.7.legacy.src.rpm

These packages are GPG signed by Fedora Legacy for security.  Our key is
available from http://www.fedoralegacy org/about/security.php

You can verify each package with the following command:

    rpm --checksig -v <filename>

If you only wish to verify that each package has not been corrupted or
tampered with, examine only the sha1sum with the following command:

    sha1sum <filename>

8. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0594
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0595

9. Contact:

The Fedora Legacy security contact is <secnotice@...oralegacy.org>. More
project details at http://www.fedoralegacy.org

---------------------------------------------------------------------

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20041007/35a085c3/attachment.bin

Powered by blists - more mailing lists