(Red Hat Issues Fix for Stronghold) PHP Heap Overflows and Other Bugs Let Users Execute Arbitrary Code or Cause Denial of Service Conditions
|
|
SecurityTracker Alert ID: 1017365
|
|
SecurityTracker URL: http://securitytracker.com/id?1017365
|
|
CVE Reference: CVE-2006-4020
(Links to External Site)
|
Date: Dec 11 2006
|
Impact: Denial of service via local system, Denial of service via network, Execution of arbitrary code via local system, Execution of arbitrary code via network, User access via local system, User access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Advisory: Red Hat Advisory
|
Description: Several vulnerabilities were reported in PHP. A user may be able to execute arbitrary code on the target system. A user may be able to cause denial of service conditions. Stronghold is affected.
In August 2006, the vendor reported several flaws in PHP that may allow a user or a remote user to execute arbitrary code on the
target system.
A buffer overflow exists in the PHP sscanf() function [CVE-2006-4020]. A script that supplies specially crafted
arguments to the sscanf() function to execute arbitrary code.
An integer overflow exists in the PHP wordwrap() and str_repeat()
functions [CVE-2006-4482]. A script running on a 64-bit server can supply specially crafted data to either function to trigger
a heap overflow and execute arbitrary code.
The 'ext/curl/interface.c' and 'ext/curl/streams.c' cURL extension files allow scripts
to bypass certain safe_mode or open_basedir access restrictions [CVE-2006-4483]. This can be exploited via the CURLOPT_FOLLOWLOCATION
option.
A buffer overflow exists in the PHP gd extension [CVE-2006-4484]. A user can supply a specially crafted GIF image to
trigger a heap overflow and execute arbitrary code.
A buffer overread exists in the PHP stripos() function [CVE-2006-4485].
A script can supply specially crafted data to the stripos() function to cause PHP to read past the end of a buffer, which may cause
denial of service conditions.
An integer overflow exists in the PHP memory allocation handling on 64-bit systems [CVE-2006-4486].
A script may be able to exceed the 'memory_limit' and cause denial of service conditions.
An integer overflow exists in the
PHP memory handling routines [CVE-2006-4812]. A script may be able to execute arbitrary code.
|
Impact: A user can execute arbitrary code on the target system.
A user can cause denial of service conditions on the target system.
|
Solution: Red Hat has issued a fix for Stronghold, which is affected by this PHP vulnerability.
SRPMS:
stronghold-php-4.1.2-11.src.rpm
0547c97d909dcaff9e934027534d398c
IA-32:
stronghold-php-4.1.2-11.i386.rpm 2760105ec84fe473228bab8ed2ad7e8a
stronghold-php-devel-4.1.2-11.i386.rpm
8bb06a430614ebfbee1ec915fbf65344
stronghold-php-imap-4.1.2-11.i386.rpm fb9b6438ebc41645a28e8f536084e21f
stronghold-php-ldap-4.1.2-11.i386.rpm
06eefc1e1a22d0b8e54d1dc26c843660
stronghold-php-manual-4.1.2-11.i386.rpm b8c3c5bbe87e737aa0dcc67f56f75307
stronghold-php-mysql-4.1.2-11.i386.rpm
ba5f1d0eb173a5273d34c022d16ed6f9
stronghold-php-odbc-4.1.2-11.i386.rpm 02ee1581128408ee4a286cc3bb83a48d
stronghold-php-pgsql-4.1.2-11.i386.rpm
5e7bf9c969b596cd51e71fc0b3424115
stronghold-php-snmp-4.1.2-11.i386.rpm fe4e64dd3f415fbda35edff97dc35e37
The Red Hat
advisory is available at:
http://rhn.redhat.com/errata/RHSA-2006-0736.html
|
Cause: Access control error, Boundary error, State error
|
Underlying OS: Linux (Red Hat Enterprise)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Mon, 11 Dec 2006 08:47:49 -0500
Subject: php security update for Stronghold
|
http://rhn.redhat.com/errata/RHSA-2006-0736.html
CVE-2006-3016
CVE-2006-4020
CVE-2006-5465
|
|
