SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   PHP Vendors:   PHP Group
(Mandrake Issues Fix) PHP Integer Overflows in pack() and unpack() and Bugs in realpath() and unserialize() May Allow Users to Bypass safe_mode and Execute Arbitrary Code
SecurityTracker Alert ID:  1012691
SecurityTracker URL:  http://securitytracker.com/id/1012691
CVE Reference:   CVE-2004-1018, CVE-2004-1019, CVE-2004-1063, CVE-2004-1064   (Links to External Site)
Date:  Dec 24 2004
Impact:   Execution of arbitrary code via local system, Execution of arbitrary code via network, User access via local system, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): prior to 4.3.10 and 5.0.3
Description:   Several vulnerabilities were reported in PHP. A local or remote user may be able to execute arbitrary code on the target system.

Stefan Esser of the Hardened-PHP Project reported a variety of vulnerabilities affecting PHP.

It is reported that the pack() and unpack() functions contain integer overflows [CVE: CVE-2004-1018]. A user may be able to supply specially crafted inputs to bypass safe_mode restrictions and execute arbitrary code with the privileges of the target web service.

It is also reported that a local user can bypass the safe_mode_exec_dir settings when safe_mode is enabled on a multithreaded UNIX/Linux web server by injecting shell commands into the name of the current directory [CVE: CVE-2004-1063].

It is also reported that a path truncation flaw in realpath() allows a user to bypass safe_mode restrictions or to include arbitrary files in certain cases [CVE: CVE-2004-1064].

Two vulnerabilities were reported in the unserialize() function [CVE: CVE-2004-1019]. Negative references or incorrect processing of references may free arbitrary memory addresses, causing arbitrary code to be executed. If a PHP application provides remote user-input to the unserialize() function, these bugs may be exploitable by remote users.

The original advisory is available at:

http://www.hardened-php.net/advisories/012004.txt

Impact:   A local or remote user may be able to execute arbitrary code on the target system.
Solution:   Mandrake has released a fix.

Mandrakelinux 10.0:
06b5483f89fd3cf9950299b628adc000 10.0/RPMS/libphp_common432-4.3.4-4.3.100mdk.i586.rpm
475b1f1ccd3cf87eb5c6cea410c6b925 10.0/RPMS/php-cgi-4.3.4-4.3.100mdk.i586.rpm
5f74765dc38dda891ce56fa4b275cce1 10.0/RPMS/php-cli-4.3.4-4.3.100mdk.i586.rpm
0d96970f65d9d53dfbb56bef9c7cf920 10.0/RPMS/php432-devel-4.3.4-4.3.100mdk.i586.rpm
3d9fd1b025b49d8b064c785982d8491f 10.0/SRPMS/php-4.3.4-4.3.100mdk.src.rpm

Mandrakelinux 10.0/AMD64:
a4302c774ce5e22e5910b1d1a130de3e amd64/10.0/RPMS/lib64php_common432-4.3.4-4.3.100mdk.amd64.rpm
aced2cc932e30532ca0243aa3bb08d68 amd64/10.0/RPMS/php-cgi-4.3.4-4.3.100mdk.amd64.rpm
49893a1fab6fbcc7a2e315784a1917ed amd64/10.0/RPMS/php-cli-4.3.4-4.3.100mdk.amd64.rpm
3ae39ad55fcc27d41e5c98c49839151d amd64/10.0/RPMS/php432-devel-4.3.4-4.3.100mdk.amd64.rpm
3d9fd1b025b49d8b064c785982d8491f amd64/10.0/SRPMS/php-4.3.4-4.3.100mdk.src.rpm

Mandrakelinux 10.1:
137904a75605f52241c384d2bc3b0c0c 10.1/RPMS/libphp_common432-4.3.8-3.2.101mdk.i586.rpm
1c9ca0459cdd747f528da02d6eca7452 10.1/RPMS/php-cgi-4.3.8-3.2.101mdk.i586.rpm
130d7a25c3a10398d993cef9319b29c8 10.1/RPMS/php-cli-4.3.8-3.2.101mdk.i586.rpm
2e4ba28a72bb6e178d06a5d85cd21948 10.1/RPMS/php432-devel-4.3.8-3.2.101mdk.i586.rpm
db09ea993e41794e44bc843054232794 10.1/SRPMS/php-4.3.8-3.2.101mdk.src.rpm

Mandrakelinux 10.1/X86_64:
a2ecb5c9c811a003a72200fe271ff1b2 x86_64/10.1/RPMS/lib64php_common432-4.3.8-3.2.101mdk.x86_64.rpm
24e125f79016925ef37e7a960482d7ee x86_64/10.1/RPMS/php-cgi-4.3.8-3.2.101mdk.x86_64.rpm
7f34cabe684c335fc8febad447d9973a x86_64/10.1/RPMS/php-cli-4.3.8-3.2.101mdk.x86_64.rpm
ea97f3e1cfe9c56ce277bb59b36c559d x86_64/10.1/RPMS/php432-devel-4.3.8-3.2.101mdk.x86_64.rpm
db09ea993e41794e44bc843054232794 x86_64/10.1/SRPMS/php-4.3.8-3.2.101mdk.src.rpm

Corporate Server 2.1:
bd0081a43d13ab1df8bb0d277172f669 corporate/2.1/RPMS/php-4.2.3-4.3.C21mdk.i586.rpm
399d388aba15e1f848aea9a6e9829a39 corporate/2.1/RPMS/php-common-4.2.3-4.3.C21mdk.i586.rpm
c28686b72864d3fdeace7cbe938dc1cc corporate/2.1/RPMS/php-devel-4.2.3-4.3.C21mdk.i586.rpm
7b65a50eb77e88581c916471d3b6ea1a corporate/2.1/RPMS/php-pear-4.2.3-4.3.C21mdk.i586.rpm
38d6e460a3372044d524cece0c9f426e corporate/2.1/SRPMS/php-4.2.3-4.3.C21mdk.src.rpm

Corporate Server 2.1/x86_64:
3234c6addd5d8d854fda9e6ec415fed7 x86_64/corporate/2.1/RPMS/php-4.2.3-4.3.C21mdk.x86_64.rpm
43001648d6a67bfa204c8a6988572f78 x86_64/corporate/2.1/RPMS/php-common-4.2.3-4.3.C21mdk.x86_64.rpm
fc41173cc7f6007168eacef722239151 x86_64/corporate/2.1/RPMS/php-devel-4.2.3-4.3.C21mdk.x86_64.rpm
bd63181af60e3010cfac7ca096cbdff3 x86_64/corporate/2.1/RPMS/php-pear-4.2.3-4.3.C21mdk.x86_64.rpm
38d6e460a3372044d524cece0c9f426e x86_64/corporate/2.1/SRPMS/php-4.2.3-4.3.C21mdk.src.rpm

Mandrakelinux 9.2:
a2efac8a1ee14a3dcfa94c6f623a1b4c 9.2/RPMS/libphp_common432-4.3.3-2.3.92mdk.i586.rpm
b85f3c02d2bba76ebbced0b64b369cd0 9.2/RPMS/php-cgi-4.3.3-2.3.92mdk.i586.rpm
0b3fca9527b45ee79ed2b8ba9c90b299 9.2/RPMS/php-cli-4.3.3-2.3.92mdk.i586.rpm
cca3b9b83930e7a96dfe26114b0008a3 9.2/RPMS/php432-devel-4.3.3-2.3.92mdk.i586.rpm
d55f284624ac1223f114c720eb7df18b 9.2/SRPMS/php-4.3.3-2.3.92mdk.src.rpm

Mandrakelinux 9.2/AMD64:
0d9742db43fdcf601b2f58e7fbc2cc05 amd64/9.2/RPMS/lib64php_common432-4.3.3-2.3.92mdk.amd64.rpm
05bb8c70036b427d0a52015dafd20c80 amd64/9.2/RPMS/php-cgi-4.3.3-2.3.92mdk.amd64.rpm
8fe4fba4ccbd6a44667d368b0cd064ea amd64/9.2/RPMS/php-cli-4.3.3-2.3.92mdk.amd64.rpm
334c12194b2d22b3a97e2dbfab1acde4 amd64/9.2/RPMS/php432-devel-4.3.3-2.3.92mdk.amd64.rpm
d55f284624ac1223f114c720eb7df18b amd64/9.2/SRPMS/php-4.3.3-2.3.92mdk.src.rpm

Vendor URL:  www.php.net/ (Links to External Site)
Cause:   Boundary error, Input validation error
Underlying OS:  Linux (Mandriva/Mandrake)
Underlying OS Comments:  10.0, 10.1, 9.2, Corporate Server 2.1

Message History:   This archive entry is a follow-up to the message listed below.
Dec 16 2004 PHP Integer Overflows in pack() and unpack() and Bugs in realpath() and unserialize() May Allow Users to Bypass safe_mode and Execute Arbitrary Code



 Source Message Contents

Subject:  [Full-Disclosure] MDKSA-2004:151 - Updated php packages fix


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

                 Mandrakelinux Security Update Advisory
 _______________________________________________________________________

 Package name:           php
 Advisory ID:            MDKSA-2004:151
 Date:                   December 17th, 2004

 Affected versions:	 10.0, 10.1, 9.2, Corporate Server 2.1
 ______________________________________________________________________

 Problem Description:

 A number of vulnerabilities in PHP versions prior to 4.3.10 were
 discovered by Stefan Esser.  Some of these vulnerabilities were not
 deemed to be severe enough to warrant CVE names, however the packages
 provided, with the exception of the Corporate Server 2.1 packages,
 include fixes for all of the vulnerabilities, thanks to the efforts of
 the OpenPKG team who extracted and backported the fixes.
 
 The vulnerabilities fixed in all provided packages include a fix for
 a possible information disclosure, double free, and negative reference
 index array underflow in deserialization code (CAN-2004-1019).  As
 well, the exif_read_data() function suffers from an overflow on a long
 sectionname; this vulnerability was discovered by Ilia Alshanetsky
 (CAN-2004-1065).
 
 The other fixes that appear in Mandrakelinux 9.2 and newer packages
 include a fix for out of bounds memory write access in shmop_write()
 and integer overflow/underflows in the pack() and unpack() functions.
 The addslashes() function did not properly escape "\0" correctly. A
 directory bypass issue existed in safe_mode execution.  There is an
 issue of arbitrary file access through path truncation.  Finally, the
 "magic_quotes_gpc" functionality could lead to one level directory
 traversal with file uploads.
 _______________________________________________________________________

 References:

  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1019
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1065
  http://www.php.net/release_4_3_10.php
  http://www.hardened-php.net/advisories/012004.txt
 ______________________________________________________________________

 Updated Packages:
  
 Mandrakelinux 10.0:
 06b5483f89fd3cf9950299b628adc000  10.0/RPMS/libphp_common432-4.3.4-4.3.100mdk.i586.rpm
 475b1f1ccd3cf87eb5c6cea410c6b925  10.0/RPMS/php-cgi-4.3.4-4.3.100mdk.i586.rpm
 5f74765dc38dda891ce56fa4b275cce1  10.0/RPMS/php-cli-4.3.4-4.3.100mdk.i586.rpm
 0d96970f65d9d53dfbb56bef9c7cf920  10.0/RPMS/php432-devel-4.3.4-4.3.100mdk.i586.rpm
 3d9fd1b025b49d8b064c785982d8491f  10.0/SRPMS/php-4.3.4-4.3.100mdk.src.rpm

 Mandrakelinux 10.0/AMD64:
 a4302c774ce5e22e5910b1d1a130de3e  amd64/10.0/RPMS/lib64php_common432-4.3.4-4.3.100mdk.amd64.rpm
 aced2cc932e30532ca0243aa3bb08d68  amd64/10.0/RPMS/php-cgi-4.3.4-4.3.100mdk.amd64.rpm
 49893a1fab6fbcc7a2e315784a1917ed  amd64/10.0/RPMS/php-cli-4.3.4-4.3.100mdk.amd64.rpm
 3ae39ad55fcc27d41e5c98c49839151d  amd64/10.0/RPMS/php432-devel-4.3.4-4.3.100mdk.amd64.rpm
 3d9fd1b025b49d8b064c785982d8491f  amd64/10.0/SRPMS/php-4.3.4-4.3.100mdk.src.rpm

 Mandrakelinux 10.1:
 137904a75605f52241c384d2bc3b0c0c  10.1/RPMS/libphp_common432-4.3.8-3.2.101mdk.i586.rpm
 1c9ca0459cdd747f528da02d6eca7452  10.1/RPMS/php-cgi-4.3.8-3.2.101mdk.i586.rpm
 130d7a25c3a10398d993cef9319b29c8  10.1/RPMS/php-cli-4.3.8-3.2.101mdk.i586.rpm
 2e4ba28a72bb6e178d06a5d85cd21948  10.1/RPMS/php432-devel-4.3.8-3.2.101mdk.i586.rpm
 db09ea993e41794e44bc843054232794  10.1/SRPMS/php-4.3.8-3.2.101mdk.src.rpm

 Mandrakelinux 10.1/X86_64:
 a2ecb5c9c811a003a72200fe271ff1b2  x86_64/10.1/RPMS/lib64php_common432-4.3.8-3.2.101mdk.x86_64.rpm
 24e125f79016925ef37e7a960482d7ee  x86_64/10.1/RPMS/php-cgi-4.3.8-3.2.101mdk.x86_64.rpm
 7f34cabe684c335fc8febad447d9973a  x86_64/10.1/RPMS/php-cli-4.3.8-3.2.101mdk.x86_64.rpm
 ea97f3e1cfe9c56ce277bb59b36c559d  x86_64/10.1/RPMS/php432-devel-4.3.8-3.2.101mdk.x86_64.rpm
 db09ea993e41794e44bc843054232794  x86_64/10.1/SRPMS/php-4.3.8-3.2.101mdk.src.rpm

 Corporate Server 2.1:
 bd0081a43d13ab1df8bb0d277172f669  corporate/2.1/RPMS/php-4.2.3-4.3.C21mdk.i586.rpm
 399d388aba15e1f848aea9a6e9829a39  corporate/2.1/RPMS/php-common-4.2.3-4.3.C21mdk.i586.rpm
 c28686b72864d3fdeace7cbe938dc1cc  corporate/2.1/RPMS/php-devel-4.2.3-4.3.C21mdk.i586.rpm
 7b65a50eb77e88581c916471d3b6ea1a  corporate/2.1/RPMS/php-pear-4.2.3-4.3.C21mdk.i586.rpm
 38d6e460a3372044d524cece0c9f426e  corporate/2.1/SRPMS/php-4.2.3-4.3.C21mdk.src.rpm

 Corporate Server 2.1/x86_64:
 3234c6addd5d8d854fda9e6ec415fed7  x86_64/corporate/2.1/RPMS/php-4.2.3-4.3.C21mdk.x86_64.rpm
 43001648d6a67bfa204c8a6988572f78  x86_64/corporate/2.1/RPMS/php-common-4.2.3-4.3.C21mdk.x86_64.rpm
 fc41173cc7f6007168eacef722239151  x86_64/corporate/2.1/RPMS/php-devel-4.2.3-4.3.C21mdk.x86_64.rpm
 bd63181af60e3010cfac7ca096cbdff3  x86_64/corporate/2.1/RPMS/php-pear-4.2.3-4.3.C21mdk.x86_64.rpm
 38d6e460a3372044d524cece0c9f426e  x86_64/corporate/2.1/SRPMS/php-4.2.3-4.3.C21mdk.src.rpm

 Mandrakelinux 9.2:
 a2efac8a1ee14a3dcfa94c6f623a1b4c  9.2/RPMS/libphp_common432-4.3.3-2.3.92mdk.i586.rpm
 b85f3c02d2bba76ebbced0b64b369cd0  9.2/RPMS/php-cgi-4.3.3-2.3.92mdk.i586.rpm
 0b3fca9527b45ee79ed2b8ba9c90b299  9.2/RPMS/php-cli-4.3.3-2.3.92mdk.i586.rpm
 cca3b9b83930e7a96dfe26114b0008a3  9.2/RPMS/php432-devel-4.3.3-2.3.92mdk.i586.rpm
 d55f284624ac1223f114c720eb7df18b  9.2/SRPMS/php-4.3.3-2.3.92mdk.src.rpm

 Mandrakelinux 9.2/AMD64:
 0d9742db43fdcf601b2f58e7fbc2cc05  amd64/9.2/RPMS/lib64php_common432-4.3.3-2.3.92mdk.amd64.rpm
 05bb8c70036b427d0a52015dafd20c80  amd64/9.2/RPMS/php-cgi-4.3.3-2.3.92mdk.amd64.rpm
 8fe4fba4ccbd6a44667d368b0cd064ea  amd64/9.2/RPMS/php-cli-4.3.3-2.3.92mdk.amd64.rpm
 334c12194b2d22b3a97e2dbfab1acde4  amd64/9.2/RPMS/php432-devel-4.3.3-2.3.92mdk.amd64.rpm
 d55f284624ac1223f114c720eb7df18b  amd64/9.2/SRPMS/php-4.3.3-2.3.92mdk.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrakeUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandrakesoft for security.  You can obtain
 the GPG public key of the Mandrakelinux Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandrakelinux at:

  http://www.mandrakesoft.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_linux-mandrake.com

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Linux Mandrake Security Team
  <security linux-mandrake.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQFBw4cHmqjQ0CJFipgRAtm+AJoD5Gh+k1UEHk6NRFAhvgNv6iN0OwCgpF8x
AjozbPYhyxkmoOOS8RCkuYU=
=QlII
-----END PGP SIGNATURE-----
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC