SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Web Server/CGI)  >   PHP Vendors:   PHP Group
(Fedora Issues Fix for PHP on RH Linux) Apache httpd Header Line Memory Allocation Lets Remote Users Crash the Server
SecurityTracker Alert ID:  1011723
SecurityTracker URL:  http://securitytracker.com/id/1011723
CVE Reference:   CVE-2004-0493   (Links to External Site)
Date:  Oct 15 2004
Impact:   Denial of service via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 2.0.49 and prior 2.x versions
Description:   A denial of service vulnerability was reported in the Apache web server in the folding of header lines. A remote user can cause the application to consume arbitrary amounts of memory. PHP is affected.

Georgi Guninski reported that a remote user can send header lines that begin with a tab or space character to cause ap_get_mime_headers_core() in 'server/protocol.c' to allocate memory for the header line. A remote user can reportedly send a large number of specially crafted header lines to cause Apache to consume all available memory on the target system and crash.

The report indicates that on 64-bit systems that have more than 4GB of virtual memory, a remote user may be able to trigger a heap-based buffer overflow, but it is not clear whether this can be exploited to execute arbitrary code or not.

The vendor has reportedly been notified.

The original advisory is available at:

http://www.guninski.com/httpd1.html

Impact:   A remote user can cause the httpd process to crash.
Solution:   Fedora has released a fix.

Red Hat Linux 7.3:

SRPM:
http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/php-4.1.2-7.3.10.legacy.src.rpm

i386:
http://download.fedoralegacy.org/redhat/7.3/updates/i386/php-4.1.2-7.3.10.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/7.3/updates/i386/php-devel-4.1.2-7.3.10.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/7.3/updates/i386/php-imap-4.1.2-7.3.10.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/7.3/updates/i386/php-ldap-4.1.2-7.3.10.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/7.3/updates/i386/php-manual-4.1.2-7.3.10.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/7.3/updates/i386/php-mysql-4.1.2-7.3.10.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/7.3/updates/i386/php-odbc-4.1.2-7.3.10.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/7.3/updates/i386/php-pgsql-4.1.2-7.3.10.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/7.3/updates/i386/php-snmp-4.1.2-7.3.10.legacy.i386.rpm

Red Hat Linux 9:

SRPM:
http://download.fedoralegacy.org/redhat/9/updates/SRPMS/php-4.2.2-17.7.legacy.src.rpm

i386:
http://download.fedoralegacy.org/redhat/9/updates/i386/php-4.2.2-17.7.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/9/updates/i386/php-devel-4.2.2-17.7.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/9/updates/i386/php-imap-4.2.2-17.7.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/9/updates/i386/php-ldap-4.2.2-17.7.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/9/updates/i386/php-manual-4.2.2-17.7.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/9/updates/i386/php-mysql-4.2.2-17.7.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/9/updates/i386/php-odbc-4.2.2-17.7.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/9/updates/i386/php-pgsql-4.2.2-17.7.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/9/updates/i386/php-snmp-4.2.2-17.7.legacy.i386.rpm

The SHA1 verification checksums are:

6aaefdbf687f8dbf9ffc7b2ab0a0ff2914a13028
redhat/7.3/updates/i386/php-4.1.2-7.3.10.legacy.i386.rpm
3f38e8929822edc377f61a05c31e45c8599a4ba6
redhat/7.3/updates/i386/php-devel-4.1.2-7.3.10.legacy.i386.rpm
8c9ac5e7c5040b2d9cf75848acc1260842a5e4aa
redhat/7.3/updates/i386/php-imap-4.1.2-7.3.10.legacy.i386.rpm
d01be5026d335032486eee9f91fdc72e43d78f54
redhat/7.3/updates/i386/php-ldap-4.1.2-7.3.10.legacy.i386.rpm
20ed3b170959f47061fbf688bd0bf6c2380cee6c
redhat/7.3/updates/i386/php-manual-4.1.2-7.3.10.legacy.i386.rpm
66413adf5bf185326ea1658d837bbd34a4c2e59b
redhat/7.3/updates/i386/php-mysql-4.1.2-7.3.10.legacy.i386.rpm
5fd105b2b8e9aea72d4e34f4800218b40fe844b9
redhat/7.3/updates/i386/php-odbc-4.1.2-7.3.10.legacy.i386.rpm
3c9152d075afc06ffb2ac64deeca3b331f3a6c06
redhat/7.3/updates/i386/php-pgsql-4.1.2-7.3.10.legacy.i386.rpm
58027e3f2bd1485bae158cf99aebc63b631972ec
redhat/7.3/updates/i386/php-snmp-4.1.2-7.3.10.legacy.i386.rpm
bd2e823603fab8b75a17647ac396263cc1ad6d7e
redhat/7.3/updates/SRPMS/php-4.1.2-7.3.10.legacy.src.rpm
594a4c87bf2b073b681b1c94a7bcf7ee7d5bc0dd
redhat/9/updates/i386/php-4.2.2-17.7.legacy.i386.rpm
e1f076f96cfce7d687ad67f26f5e1c33f5993270
redhat/9/updates/i386/php-devel-4.2.2-17.7.legacy.i386.rpm
d349ace9d0a8514cd563217d56ef1f25261f2c92
redhat/9/updates/i386/php-imap-4.2.2-17.7.legacy.i386.rpm
176e15f14ec6045aefd9c924dfa383c58598e16d
redhat/9/updates/i386/php-ldap-4.2.2-17.7.legacy.i386.rpm
a6cda124e7a2de4083bec0a78f6758ab9f36a374
redhat/9/updates/i386/php-manual-4.2.2-17.7.legacy.i386.rpm
42a87a54e0502721eec4907a8cb1c8db196c442a
redhat/9/updates/i386/php-mysql-4.2.2-17.7.legacy.i386.rpm
117bc0f478babf8317812fc35c763e8afeccca49
redhat/9/updates/i386/php-odbc-4.2.2-17.7.legacy.i386.rpm
c52bb318d8b217c02b61bd277f662a483e05e61b
redhat/9/updates/i386/php-pgsql-4.2.2-17.7.legacy.i386.rpm
6ec57d0958666d97532099d7f1118a52727db02b
redhat/9/updates/i386/php-snmp-4.2.2-17.7.legacy.i386.rpm
40e6bb2279a9154ecf0c313c39ab563c6de5a8ad
redhat/9/updates/SRPMS/php-4.2.2-17.7.legacy.src.rpm

Vendor URL:  www.php.net (Links to External Site)
Cause:   Resource error
Underlying OS:  Linux (Red Hat Linux)
Underlying OS Comments:  7.3, 9

Message History:   This archive entry is a follow-up to the message listed below.
Jun 28 2004 Apache httpd Header Line Memory Allocation Lets Remote Users Crash the Server



 Source Message Contents

Subject:  [Full-Disclosure] [FLSA-2004:1868] Updated php packages fix security issues



--=-m3WWhrmzKEKi9Lt9tVE0
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

-----------------------------------------------------------------------
               Fedora Legacy Update Advisory

Synopsis:          Updated php packages fix security issues
Advisory ID:       FLSA:1868
Issue date:        2004-10-07
Product:           Red Hat Linux
Keywords:          Bugfix
Cross references:  https://bugzilla.fedora.us/show_bug.cgi?id=3D1868
CVE Names:         CAN-2004-0594 CAN-2004-0595
-----------------------------------------------------------------------


-----------------------------------------------------------------------
1. Topic:

Updated php packages that fix various security issues are now available.

PHP is an HTML-embedded scripting language commonly used with the Apache
HTTP server.

2. Relevant releases/architectures:

Red Hat Linux 7.3 - i386
Red Hat Linux 9 - i386

3. Problem description:

Stefan Esser discovered a flaw when memory_limit is enabled in versions
of PHP 4 before 4.3.8. If a remote attacker could force the PHP
interpreter to allocate more memory than the memory_limit setting before
script execution begins, then the attacker may be able to supply the
contents of a PHP hash table remotely. This hash table could then be
used to execute arbitrary code as the 'apache' user. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the
name CAN-2004-0594 to this issue.

This issue has a higher risk when PHP is running on an instance of
Apache which is vulnerable to CAN-2004-0493. It may also be possible to
exploit this issue if using a non-default PHP configuration with the
"register_defaults" setting is changed to "On".

Stefan Esser discovered a flaw in the strip_tags function in versions of
PHP before 4.3.8. The strip_tags function is commonly used by PHP
scripts to prevent Cross-Site-Scripting attacks by removing HTML tags
from user-supplied form data. By embedding NUL bytes into form data,
HTML tags can in some cases be passed intact through the strip_tags
function, which may allow a Cross-Site-Scripting attack. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the
name CAN-2004-0595 to this issue.

All users of PHP are advised to upgrade to these updated packages, which
contain backported patches that address these issues.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade.  Only those
RPMs which are currently installed will be updated.  Those RPMs which
are not installed but included in the list will not be updated.  Note
that you can also use wildcards (*.rpm) if your current directory *only*
contains the desired RPMs.

Please note that this update is also available via yum and apt.  Many
people find this an easier way to apply updates.  To use yum issue:

yum update

or to use apt:

apt-get update; apt-get upgrade

This will start an interactive process that will result in the
appropriate RPMs being upgraded on your system.  This assumes that you
have yum or apt-get configured for obtaining Fedora Legacy content.
Please visit http://www fedoralegacy.org/docs for directions on how to
configure yum and apt-get.

5. Bug IDs fixed:

http://bugzilla.fedora.us - 1868 - CAN-2004-0594, 0595 - PHP multiple
vulnerabilities

6. RPMs required:

Red Hat Linux 7.3:

SRPM:
http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/php-4.1.2-7.3.10.=
legacy.src.rpm

i386:
http://download.fedoralegacy.org/redhat/7.3/updates/i386/php-4.1.2-7.3.10.l=
egacy.i386.rpm
http://download.fedoralegacy.org/redhat/7.3/updates/i386/php-devel-4.1.2-7.=
3.10.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/7.3/updates/i386/php-imap-4.1.2-7.3=
.10.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/7.3/updates/i386/php-ldap-4.1.2-7.3=
.10.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/7.3/updates/i386/php-manual-4.1.2-7=
.3.10.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/7.3/updates/i386/php-mysql-4.1.2-7.=
3.10.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/7.3/updates/i386/php-odbc-4.1.2-7.3=
.10.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/7.3/updates/i386/php-pgsql-4.1.2-7.=
3.10.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/7.3/updates/i386/php-snmp-4.1.2-7.3=
.10.legacy.i386.rpm

Red Hat Linux 9:

SRPM:
http://download.fedoralegacy.org/redhat/9/updates/SRPMS/php-4.2.2-17.7.lega=
cy.src.rpm

i386:
http://download.fedoralegacy.org/redhat/9/updates/i386/php-4.2.2-17.7.legac=
y.i386.rpm
http://download.fedoralegacy.org/redhat/9/updates/i386/php-devel-4.2.2-17.7=
.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/9/updates/i386/php-imap-4.2.2-17.7.=
legacy.i386.rpm
http://download.fedoralegacy.org/redhat/9/updates/i386/php-ldap-4.2.2-17.7.=
legacy.i386.rpm
http://download.fedoralegacy.org/redhat/9/updates/i386/php-manual-4.2.2-17.=
7.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/9/updates/i386/php-mysql-4.2.2-17.7=
.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/9/updates/i386/php-odbc-4.2.2-17.7.=
legacy.i386.rpm
http://download.fedoralegacy.org/redhat/9/updates/i386/php-pgsql-4.2.2-17.7=
.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/9/updates/i386/php-snmp-4.2.2-17.7.=
legacy.i386.rpm

7. Verification:

SHA1 sum                                 Package Name
---------------------------------------------------------------------------

6aaefdbf687f8dbf9ffc7b2ab0a0ff2914a13028=20
redhat/7.3/updates/i386/php-4.1.2-7.3.10.legacy.i386.rpm
3f38e8929822edc377f61a05c31e45c8599a4ba6=20
redhat/7.3/updates/i386/php-devel-4.1.2-7.3.10.legacy.i386.rpm
8c9ac5e7c5040b2d9cf75848acc1260842a5e4aa=20
redhat/7.3/updates/i386/php-imap-4.1.2-7.3.10.legacy.i386.rpm
d01be5026d335032486eee9f91fdc72e43d78f54=20
redhat/7.3/updates/i386/php-ldap-4.1.2-7.3.10.legacy.i386.rpm
20ed3b170959f47061fbf688bd0bf6c2380cee6c=20
redhat/7.3/updates/i386/php-manual-4.1.2-7.3.10.legacy.i386.rpm
66413adf5bf185326ea1658d837bbd34a4c2e59b=20
redhat/7.3/updates/i386/php-mysql-4.1.2-7.3.10.legacy.i386.rpm
5fd105b2b8e9aea72d4e34f4800218b40fe844b9=20
redhat/7.3/updates/i386/php-odbc-4.1.2-7.3.10.legacy.i386.rpm
3c9152d075afc06ffb2ac64deeca3b331f3a6c06=20
redhat/7.3/updates/i386/php-pgsql-4.1.2-7.3.10.legacy.i386.rpm
58027e3f2bd1485bae158cf99aebc63b631972ec=20
redhat/7.3/updates/i386/php-snmp-4.1.2-7.3.10.legacy.i386.rpm
bd2e823603fab8b75a17647ac396263cc1ad6d7e=20
redhat/7.3/updates/SRPMS/php-4.1.2-7.3.10.legacy.src.rpm
594a4c87bf2b073b681b1c94a7bcf7ee7d5bc0dd=20
redhat/9/updates/i386/php-4.2.2-17.7.legacy.i386.rpm
e1f076f96cfce7d687ad67f26f5e1c33f5993270=20
redhat/9/updates/i386/php-devel-4.2.2-17.7.legacy.i386.rpm
d349ace9d0a8514cd563217d56ef1f25261f2c92=20
redhat/9/updates/i386/php-imap-4.2.2-17.7.legacy.i386.rpm
176e15f14ec6045aefd9c924dfa383c58598e16d=20
redhat/9/updates/i386/php-ldap-4.2.2-17.7.legacy.i386.rpm
a6cda124e7a2de4083bec0a78f6758ab9f36a374=20
redhat/9/updates/i386/php-manual-4.2.2-17.7.legacy.i386.rpm
42a87a54e0502721eec4907a8cb1c8db196c442a=20
redhat/9/updates/i386/php-mysql-4.2.2-17.7.legacy.i386.rpm
117bc0f478babf8317812fc35c763e8afeccca49=20
redhat/9/updates/i386/php-odbc-4.2.2-17.7.legacy.i386.rpm
c52bb318d8b217c02b61bd277f662a483e05e61b=20
redhat/9/updates/i386/php-pgsql-4.2.2-17.7.legacy.i386.rpm
6ec57d0958666d97532099d7f1118a52727db02b=20
redhat/9/updates/i386/php-snmp-4.2.2-17.7.legacy.i386.rpm
40e6bb2279a9154ecf0c313c39ab563c6de5a8ad=20
redhat/9/updates/SRPMS/php-4.2.2-17.7.legacy.src.rpm

These packages are GPG signed by Fedora Legacy for security.  Our key is
available from http://www.fedoralegacy org/about/security.php

You can verify each package with the following command:

    rpm --checksig -v <filename>

If you only wish to verify that each package has not been corrupted or
tampered with, examine only the sha1sum with the following command:

    sha1sum <filename>

8. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCAN-2004-0594
http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCAN-2004-0595

9. Contact:

The Fedora Legacy security contact is <secnotice@fedoralegacy.org>. More
project details at http://www.fedoralegacy.org

---------------------------------------------------------------------


--=-m3WWhrmzKEKi9Lt9tVE0
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQBBZeGSLMAs/0C4zNoRAoyyAKCHYfgBJjLyfDd5ewZo1vUo77edggCff5mr
dpxUrJOi3OhFKb4sD6YKsr4=
=ssTY
-----END PGP SIGNATURE-----

--=-m3WWhrmzKEKi9Lt9tVE0--

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC