Message-ID: <4B43AAAF.6060402@gentoo.org>
Date: Tue, 05 Jan 2010 22:10:07 +0100
From: Tobias Heinlein <keytoaster@...too.org>
To: gentoo-announce@...too.org
Cc: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com,
	security-alerts@...uxsecurity.com
Subject: [ GLSA 201001-03 ] PHP: Multiple vulnerabilities

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 201001-03
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                            http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

  Severity: High
     Title: PHP: Multiple vulnerabilities
      Date: January 05, 2010
      Bugs: #249875, #255121, #260576, #261192, #266125, #274670,
#280602, #285434, #292132, #293888, #297369, #297370
        ID: 201001-03

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

Multiple vulnerabilities were found in PHP, the worst of which leading
to the remote execution of arbitrary code.

Background
==========

PHP is a widely-used general-purpose scripting language that is
especially suited for Web development and can be embedded into HTML.

Affected packages
=================

    -------------------------------------------------------------------
     Package       /  Vulnerable  /                         Unaffected
    -------------------------------------------------------------------
  1  dev-lang/php      < 5.2.12                              >= 5.2.12

Description
===========

Multiple vulnerabilities have been discovered in PHP. Please review the
CVE identifiers referenced below and the associated PHP release notes
for details.

Impact
======

A context-dependent attacker could execute arbitrary code via a
specially crafted string containing an HTML entity when the mbstring
extension is enabled. Furthermore a remote attacker could execute
arbitrary code via a specially crafted GD graphics file.

A remote attacker could also cause a Denial of Service via a malformed
string passed to the json_decode() function, via a specially crafted
ZIP file passed to the php_zip_make_relative_path() function, via a
malformed JPEG image passed to the exif_read_data() function, or via
temporary file exhaustion. It is also possible for an attacker to spoof
certificates, bypass various safe_mode and open_basedir restrictions
when certain criteria are met, perform Cross-site scripting attacks,
more easily perform SQL injection attacks, manipulate settings of other
virtual hosts on the same server via a malicious .htaccess entry when
running on Apache, disclose memory portions, and write arbitrary files
via a specially crafted ZIP archive. Some vulnerabilities with unknown
impact and attack vectors have been reported as well.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All PHP users should upgrade to the latest version. As PHP is
statically linked against a vulnerable version of the c-client library
when the imap or kolab USE flag is enabled (GLSA 200911-03), users
should upgrade net-libs/c-client beforehand:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=net-libs/c-client-2007e"
    # emerge --ask --oneshot --verbose ">=dev-lang/php-5.2.12"

References
==========

  [ 1 ] CVE-2008-5498
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5498
  [ 2 ] CVE-2008-5514
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5514
  [ 3 ] CVE-2008-5557
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5557
  [ 4 ] CVE-2008-5624
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5624
  [ 5 ] CVE-2008-5625
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5625
  [ 6 ] CVE-2008-5658
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5658
  [ 7 ] CVE-2008-5814
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5814
  [ 8 ] CVE-2008-5844
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5844
  [ 9 ] CVE-2008-7002
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-7002
  [ 10 ] CVE-2009-0754
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0754
  [ 11 ] CVE-2009-1271
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1271
  [ 12 ] CVE-2009-1272
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1272
  [ 13 ] CVE-2009-2626
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2626
  [ 14 ] CVE-2009-2687
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2687
  [ 15 ] CVE-2009-3291
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3291
  [ 16 ] CVE-2009-3292
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3292
  [ 17 ] CVE-2009-3293
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3293
  [ 18 ] CVE-2009-3546
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3546
  [ 19 ] CVE-2009-3557
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3557
  [ 20 ] CVE-2009-3558
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3558
  [ 21 ] CVE-2009-4017
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4017
  [ 22 ] CVE-2009-4142
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4142
  [ 23 ] CVE-2009-4143
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4143
  [ 24 ] GLSA 200911-03
         http://www.gentoo.org/security/en/glsa/glsa-200911-03.xml

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

  http://security.gentoo.org/glsa/glsa-201001-03.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@...too.org or alternatively, you may file a bug at
https://bugs.gentoo.org.

License
=======

Copyright 2010 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5


Download attachment "signature.asc" of type "application/pgp-signature" (199 bytes)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists