SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service
Report a Bug
Report a vulnerability that you have found to SecurityTracker
bugs
@
securitytracker.com





Category:   Application (Generic)  >   PHP Vendors:   PHP Group
(Red Hat Issues Fix) PHP Command Parameter Bug Lets Remote Users Obtain Potentially Sensitive Information and Execute Arbitrary Code
SecurityTracker Alert ID:  1027055
SecurityTracker URL:  http://securitytracker.com/id/1027055
CVE Reference:   CVE-2012-1823   (Links to External Site)
Updated:  May 10 2012
Original Entry Date:  May 10 2012
Impact:   Disclosure of system information, Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  Exploit Included:  Yes  
Version(s): prior to 5.3.12 and 5.4.2
Description:   A vulnerability was reported in PHP. A remote user can obtain potentially sensitive information. A remote user can execute arbitrary code on the target system.

A remote user can submit a specially crafted request containing a command line switch to cause the php-cgi binary to execute the parameter.

Systems where PHP is used in a CGI-based setup (e.g., Apache mod_cgi) may be affected.

Systems using Apache mod_php or nginx with php-fpm are not affected.

A demonstration exploit URL is provided:

http://[target]/index.php?-s

This vulnerability is being actively exploited.

The original advisory is available at:

http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/

De Eindbazen reported this vulnerability.
Impact:   A remote user can obtain potentially sensitive information.

A remote user can execute arbitrary code on the target system.
Solution:   Red Hat has issued a fix for CVE-2012-1823.

Red Hat is not affected by CVE-2012-2311.

The Red Hat advisory is available at:

https://rhn.redhat.com/errata/RHSA-2012-0569.html
Vendor URL:  www.php.net/archive/2012.php#id2012-05-03-1 (Links to External Site)
Cause:   Access control error
Underlying OS:   Linux (Red Hat Enterprise)

Message History:   This archive entry is a follow-up to the message listed below.
May 4 2012 PHP Command Parameter Bug Lets Remote Users Obtain Potentially Sensitive Information and Execute Arbitrary Code


 Source Message Contents
Date:  Thu, 10 May 2012 15:37:16 +0000
Subject:  [RHSA-2012:0569-01] Critical: php53 security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Critical: php53 security update
Advisory ID:       RHSA-2012:0569-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2012-0569.html
Issue date:        2012-05-10
CVE Names:         CVE-2012-1823 
=====================================================================

1. Summary:

Updated php53 packages that fix one security issue are now available for
Red Hat Enterprise Linux 5.6 Extended Update Support.

The Red Hat Security Response Team has rated this update as having critical
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux EUS (v. 5.6 server) - i386, ia64, ppc, s390x, x86_64

3. Description:

PHP is an HTML-embedded scripting language commonly used with the Apache
HTTP Server.

A flaw was found in the way the php-cgi executable processed command line
arguments when running in CGI mode. A remote attacker could send a
specially-crafted request to a PHP script that would result in the query
string being parsed by php-cgi as command line options and arguments. This
could lead to the disclosure of the script's source code or arbitrary code
execution with the privileges of the PHP interpreter. (CVE-2012-1823)

Red Hat is aware that a public exploit for this issue is available that
allows remote code execution in affected PHP CGI configurations. This flaw
does not affect the default configuration using the PHP module for Apache
httpd to handle PHP scripts.

All php53 users should upgrade to these updated packages, which contain a
backported patch to resolve this issue. After installing the updated
packages, the httpd daemon must be restarted for the update to take effect.

4. Solution:

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

5. Bugs fixed (http://bugzilla.redhat.com/):

818607 - CVE-2012-1823 php: command line arguments injection when run in CGI mode (VU#520827)

6. Package List:

Red Hat Enterprise Linux EUS (v. 5.6 server):

Source:
php53-5.3.3-1.el5_6.2.src.rpm

i386:
php53-5.3.3-1.el5_6.2.i386.rpm
php53-bcmath-5.3.3-1.el5_6.2.i386.rpm
php53-cli-5.3.3-1.el5_6.2.i386.rpm
php53-common-5.3.3-1.el5_6.2.i386.rpm
php53-dba-5.3.3-1.el5_6.2.i386.rpm
php53-debuginfo-5.3.3-1.el5_6.2.i386.rpm
php53-devel-5.3.3-1.el5_6.2.i386.rpm
php53-gd-5.3.3-1.el5_6.2.i386.rpm
php53-imap-5.3.3-1.el5_6.2.i386.rpm
php53-intl-5.3.3-1.el5_6.2.i386.rpm
php53-ldap-5.3.3-1.el5_6.2.i386.rpm
php53-mbstring-5.3.3-1.el5_6.2.i386.rpm
php53-mysql-5.3.3-1.el5_6.2.i386.rpm
php53-odbc-5.3.3-1.el5_6.2.i386.rpm
php53-pdo-5.3.3-1.el5_6.2.i386.rpm
php53-pgsql-5.3.3-1.el5_6.2.i386.rpm
php53-process-5.3.3-1.el5_6.2.i386.rpm
php53-pspell-5.3.3-1.el5_6.2.i386.rpm
php53-snmp-5.3.3-1.el5_6.2.i386.rpm
php53-soap-5.3.3-1.el5_6.2.i386.rpm
php53-xml-5.3.3-1.el5_6.2.i386.rpm
php53-xmlrpc-5.3.3-1.el5_6.2.i386.rpm

ia64:
php53-5.3.3-1.el5_6.2.ia64.rpm
php53-bcmath-5.3.3-1.el5_6.2.ia64.rpm
php53-cli-5.3.3-1.el5_6.2.ia64.rpm
php53-common-5.3.3-1.el5_6.2.ia64.rpm
php53-dba-5.3.3-1.el5_6.2.ia64.rpm
php53-debuginfo-5.3.3-1.el5_6.2.ia64.rpm
php53-devel-5.3.3-1.el5_6.2.ia64.rpm
php53-gd-5.3.3-1.el5_6.2.ia64.rpm
php53-imap-5.3.3-1.el5_6.2.ia64.rpm
php53-intl-5.3.3-1.el5_6.2.ia64.rpm
php53-ldap-5.3.3-1.el5_6.2.ia64.rpm
php53-mbstring-5.3.3-1.el5_6.2.ia64.rpm
php53-mysql-5.3.3-1.el5_6.2.ia64.rpm
php53-odbc-5.3.3-1.el5_6.2.ia64.rpm
php53-pdo-5.3.3-1.el5_6.2.ia64.rpm
php53-pgsql-5.3.3-1.el5_6.2.ia64.rpm
php53-process-5.3.3-1.el5_6.2.ia64.rpm
php53-pspell-5.3.3-1.el5_6.2.ia64.rpm
php53-snmp-5.3.3-1.el5_6.2.ia64.rpm
php53-soap-5.3.3-1.el5_6.2.ia64.rpm
php53-xml-5.3.3-1.el5_6.2.ia64.rpm
php53-xmlrpc-5.3.3-1.el5_6.2.ia64.rpm

ppc:
php53-5.3.3-1.el5_6.2.ppc.rpm
php53-bcmath-5.3.3-1.el5_6.2.ppc.rpm
php53-cli-5.3.3-1.el5_6.2.ppc.rpm
php53-common-5.3.3-1.el5_6.2.ppc.rpm
php53-dba-5.3.3-1.el5_6.2.ppc.rpm
php53-debuginfo-5.3.3-1.el5_6.2.ppc.rpm
php53-devel-5.3.3-1.el5_6.2.ppc.rpm
php53-gd-5.3.3-1.el5_6.2.ppc.rpm
php53-imap-5.3.3-1.el5_6.2.ppc.rpm
php53-intl-5.3.3-1.el5_6.2.ppc.rpm
php53-ldap-5.3.3-1.el5_6.2.ppc.rpm
php53-mbstring-5.3.3-1.el5_6.2.ppc.rpm
php53-mysql-5.3.3-1.el5_6.2.ppc.rpm
php53-odbc-5.3.3-1.el5_6.2.ppc.rpm
php53-pdo-5.3.3-1.el5_6.2.ppc.rpm
php53-pgsql-5.3.3-1.el5_6.2.ppc.rpm
php53-process-5.3.3-1.el5_6.2.ppc.rpm
php53-pspell-5.3.3-1.el5_6.2.ppc.rpm
php53-snmp-5.3.3-1.el5_6.2.ppc.rpm
php53-soap-5.3.3-1.el5_6.2.ppc.rpm
php53-xml-5.3.3-1.el5_6.2.ppc.rpm
php53-xmlrpc-5.3.3-1.el5_6.2.ppc.rpm

s390x:
php53-5.3.3-1.el5_6.2.s390x.rpm
php53-bcmath-5.3.3-1.el5_6.2.s390x.rpm
php53-cli-5.3.3-1.el5_6.2.s390x.rpm
php53-common-5.3.3-1.el5_6.2.s390x.rpm
php53-dba-5.3.3-1.el5_6.2.s390x.rpm
php53-debuginfo-5.3.3-1.el5_6.2.s390x.rpm
php53-devel-5.3.3-1.el5_6.2.s390x.rpm
php53-gd-5.3.3-1.el5_6.2.s390x.rpm
php53-imap-5.3.3-1.el5_6.2.s390x.rpm
php53-intl-5.3.3-1.el5_6.2.s390x.rpm
php53-ldap-5.3.3-1.el5_6.2.s390x.rpm
php53-mbstring-5.3.3-1.el5_6.2.s390x.rpm
php53-mysql-5.3.3-1.el5_6.2.s390x.rpm
php53-odbc-5.3.3-1.el5_6.2.s390x.rpm
php53-pdo-5.3.3-1.el5_6.2.s390x.rpm
php53-pgsql-5.3.3-1.el5_6.2.s390x.rpm
php53-process-5.3.3-1.el5_6.2.s390x.rpm
php53-pspell-5.3.3-1.el5_6.2.s390x.rpm
php53-snmp-5.3.3-1.el5_6.2.s390x.rpm
php53-soap-5.3.3-1.el5_6.2.s390x.rpm
php53-xml-5.3.3-1.el5_6.2.s390x.rpm
php53-xmlrpc-5.3.3-1.el5_6.2.s390x.rpm

x86_64:
php53-5.3.3-1.el5_6.2.x86_64.rpm
php53-bcmath-5.3.3-1.el5_6.2.x86_64.rpm
php53-cli-5.3.3-1.el5_6.2.x86_64.rpm
php53-common-5.3.3-1.el5_6.2.x86_64.rpm
php53-dba-5.3.3-1.el5_6.2.x86_64.rpm
php53-debuginfo-5.3.3-1.el5_6.2.x86_64.rpm
php53-devel-5.3.3-1.el5_6.2.x86_64.rpm
php53-gd-5.3.3-1.el5_6.2.x86_64.rpm
php53-imap-5.3.3-1.el5_6.2.x86_64.rpm
php53-intl-5.3.3-1.el5_6.2.x86_64.rpm
php53-ldap-5.3.3-1.el5_6.2.x86_64.rpm
php53-mbstring-5.3.3-1.el5_6.2.x86_64.rpm
php53-mysql-5.3.3-1.el5_6.2.x86_64.rpm
php53-odbc-5.3.3-1.el5_6.2.x86_64.rpm
php53-pdo-5.3.3-1.el5_6.2.x86_64.rpm
php53-pgsql-5.3.3-1.el5_6.2.x86_64.rpm
php53-process-5.3.3-1.el5_6.2.x86_64.rpm
php53-pspell-5.3.3-1.el5_6.2.x86_64.rpm
php53-snmp-5.3.3-1.el5_6.2.x86_64.rpm
php53-soap-5.3.3-1.el5_6.2.x86_64.rpm
php53-xml-5.3.3-1.el5_6.2.x86_64.rpm
php53-xmlrpc-5.3.3-1.el5_6.2.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/#package

7. References:

https://www.redhat.com/security/data/cve/CVE-2012-1823.html
https://access.redhat.com/security/updates/classification/#critical

8. Contact:

The Red Hat security contact is <secalert@redhat.com>.  More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2012 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFPq+CTXlSAg2UNWIIRAuXYAKCdvgQ8EA8+ROA8YDlnAPCgsgKllACeJUar
mjye+4nPj7WUvLKkubghTAg=
=pz2k
-----END PGP SIGNATURE-----


--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce


Go to the Top of This SecurityTracker Archive Page



Home   |    View Topics   |    Search   |    Contact Us

Copyright 2013, SecurityGlobal.net LLC