__________________________________________________________
The U.S. Department of Energy
Computer Incident Advisory Capability
___ __ __ _ ___
/ | /_\ /
\___ __|__ / \ \___
__________________________________________________________
INFORMATION BULLETIN
PHP Security Bugs
[Red Hat Security Advisory RHSA-2005:405-06]
April 29, 2005 17:00 GMT Number P-197
[REVISED 04 May 2005]
[REVISED 09 May 2005]
[REVISED 26 May 2005]
______________________________________________________________________________
PROBLEM: Various security related bugs were discovered in PHP, an
HTML-embedded scripting language commonly used with the Apache
HTTP Web server.
PLATFORM: Red Hat Desktop (v. 3, 4)
Red Hat Enterprise Linux AS (v. 3, 4)
Red Hat Enterprise Linux ES (v. 3, 4)
Red Hat Enterprise Linux WS (v. 3, 4)
SGI ProPack 3 Service Pack 5 for SGI Altix family of systems
Debian GNU/Linux 3.0 alias woody
DAMAGE: Several security vulnerabilities were addressed, including a
bug in the cURL extension that may allow remote attackers to
read arbitrary files via a file: URL argument to the curl_init
function.
SOLUTION: Apply available security updates.
______________________________________________________________________________
VULNERABILITY The risk is LOW. Exploiting this vulnerability may lead to
ASSESSMENT: disclosure of sensitive information.
______________________________________________________________________________
LINKS:
CIAC BULLETIN: http://www.ciac.org/ciac/bulletins/p-197.shtml
ORIGINAL BULLETIN: https://rhn.redhat.com/errata/RHSA-2005-405.html
ADDITIONAL LINKS: Red Hat Security Advisory RHSA-2005:406-11
https://rhn.redhat.com/errata/RHSA-2005-406.html
SGI Security Advisory Number 20050501-01-U
ftp://patches.sgi.com/support/free/security/advisories/20050501-01-U.asc
Debian Security Advisory DSA-729-1
http://www.debian.org/security/2005/dsa-729
CVE/CAN: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=
CAN-2004-1392 CAN-2005-0524 CAN-2005-0525 CAN-2005-1042
CAN-2005-1043
______________________________________________________________________________
REVISION HISTORY:
05/05/05 - Red Hat added fixes for Red Hat Desktop (v.4), Red Hat Enterprise Linux AS (v.4),
Red Hat Enterprise Linux ES (v.4), and Red Hat Enterprise Linux WS (v.4).
05/09/05 - added a link to SGI Security Advisory 20050501-01-U.
05/26/05 - added a link to Debian Security Advisory DSA-729-1 for Debian
GNU/Linux 3.0 alias woody.
[***** Start Red Hat Security Advisory RHSA-2005:405-06 *****]
Moderate: PHP security update
Advisory: RHSA-2005:405-06
Type: Security Advisory
Issued on: 2005-04-28
Last updated on: 2005-04-28
Affected Products: Red Hat Desktop (v. 3)
Red Hat Enterprise Linux AS (v. 3)
Red Hat Enterprise Linux ES (v. 3)
Red Hat Enterprise Linux WS (v. 3)
CVEs (cve.mitre.org): CAN-2004-1392
CAN-2005-0524
CAN-2005-0525
CAN-2005-1042
CAN-2005-1043
Details
Updated PHP packages that fix various security issues are now available.
This update has been rated as having moderate security impact by the Red
Hat Security Response Team.
PHP is an HTML-embedded scripting language commonly used with the Apache
HTTP Web server.
A bug was found in the way PHP processes IFF and JPEG images. It is
possible to cause PHP to consume CPU resources for a short period of time
by supplying a carefully crafted IFF or JPEG image. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the
names CAN-2005-0524 and CAN-2005-0525 to these issues.
A buffer overflow bug was also found in the way PHP processes EXIF image
headers. It is possible for an attacker to construct an image file in such
a way that it could execute arbitrary instructions when processed by PHP.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2005-1042 to this issue.
A denial of service bug was found in the way PHP processes EXIF image
headers. It is possible for an attacker to cause PHP to enter an infinite
loop for a short period of time by supplying a carefully crafted image file
to PHP for processing. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2005-1043 to this issue.
Several bug fixes are also included in this update:
- The security fixes in RHSA-2004-687 to the "unserializer" code introduced
some performance issues.
- In the gd extension, the "imagecopymerge" function did not correctly
handle transparency. The original image was being obscured in the
resultant image.
- In the curl extension, safe mode was not enforced for 'file:///' URL
lookups (CAN-2004-1392).
Users of PHP should upgrade to these updated packages, which contain
backported fixes for these issues.
Solution
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:
up2date
For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:
http://www.redhat.com/docs/manuals/enterprise/
Updated packages
Red Hat Desktop (v. 3)
SRPMS:
php-4.3.2-23.ent.src.rpm 58f0cca1256d18f4146f2ec006dc4fd5
IA-32:
php-4.3.2-23.ent.i386.rpm 90b3771b6440bd401c5c33d915806fc4
php-devel-4.3.2-23.ent.i386.rpm fb284c7c36219ac32f9a8adee7c13d4c
php-imap-4.3.2-23.ent.i386.rpm 6ca14b0b08f188e34e833017affe5a2e
php-ldap-4.3.2-23.ent.i386.rpm ee3952c56bc244a825035f7e7facda68
php-mysql-4.3.2-23.ent.i386.rpm bbe31e769f917c47da06b6f864bd4d0f
php-odbc-4.3.2-23.ent.i386.rpm dd9118b190805f299c24a3e3e5154cd4
php-pgsql-4.3.2-23.ent.i386.rpm 28b2599fcc44d5cff95670fd29cb49ce
x86_64:
php-4.3.2-23.ent.x86_64.rpm c65c9126a358d58c66caf072cef65ecd
php-devel-4.3.2-23.ent.x86_64.rpm c0a73dfa0b22cec4b3d1ecaaa37fc26d
php-imap-4.3.2-23.ent.x86_64.rpm ec5f608371824dc3306738f6d51c9677
php-ldap-4.3.2-23.ent.x86_64.rpm 4f4229af5ccdca0feda092dba5d50ea7
php-mysql-4.3.2-23.ent.x86_64.rpm 4e902c4400e3d472df8d5dbc6c8126d2
php-odbc-4.3.2-23.ent.x86_64.rpm 93a762b570dea3a35a8461a3ad43632c
php-pgsql-4.3.2-23.ent.x86_64.rpm be166ccd9909d1eba95d3fadc0aad6a3
Red Hat Enterprise Linux AS (v. 3)
SRPMS:
php-4.3.2-23.ent.src.rpm 58f0cca1256d18f4146f2ec006dc4fd5
IA-32:
php-4.3.2-23.ent.i386.rpm 90b3771b6440bd401c5c33d915806fc4
php-devel-4.3.2-23.ent.i386.rpm fb284c7c36219ac32f9a8adee7c13d4c
php-imap-4.3.2-23.ent.i386.rpm 6ca14b0b08f188e34e833017affe5a2e
php-ldap-4.3.2-23.ent.i386.rpm ee3952c56bc244a825035f7e7facda68
php-mysql-4.3.2-23.ent.i386.rpm bbe31e769f917c47da06b6f864bd4d0f
php-odbc-4.3.2-23.ent.i386.rpm dd9118b190805f299c24a3e3e5154cd4
php-pgsql-4.3.2-23.ent.i386.rpm 28b2599fcc44d5cff95670fd29cb49ce
IA-64:
php-4.3.2-23.ent.ia64.rpm ae30b9198b8908dd0e42e54f5cc094e5
php-devel-4.3.2-23.ent.ia64.rpm c02c359cf20fc772088e9d1df5549d8b
php-imap-4.3.2-23.ent.ia64.rpm 2506f030c45ddb1ccc6ddce44e17fc08
php-ldap-4.3.2-23.ent.ia64.rpm 0529fd8d9cbc47d16d5f3f81639b985f
php-mysql-4.3.2-23.ent.ia64.rpm f39b5fcc428e67a85d3ea91de36c0f0f
php-odbc-4.3.2-23.ent.ia64.rpm 7f72f5cca6c29fa56e71641fa60aa133
php-pgsql-4.3.2-23.ent.ia64.rpm 0df7c3e84d8b818565a30a11e5303b6d
PPC:
php-4.3.2-23.ent.ppc.rpm 1d106837f13833934d36cd40b1656a31
php-devel-4.3.2-23.ent.ppc.rpm 3a490c937d75c426adad35e2a28f308d
php-imap-4.3.2-23.ent.ppc.rpm 048861f82d2596f722bd1af0edb43e2c
php-ldap-4.3.2-23.ent.ppc.rpm 48838c0212c8647f4e13f0a8bd13924b
php-mysql-4.3.2-23.ent.ppc.rpm 8d414fd1c5cc0b8f847d2aec8a7c5cdd
php-odbc-4.3.2-23.ent.ppc.rpm de5cccba75b024dc074b0e532cc8da62
php-pgsql-4.3.2-23.ent.ppc.rpm 33c39c6dde048b7ee2b86ffd00cca63b
s390:
php-4.3.2-23.ent.s390.rpm de50da7e22ae20bcc603c5a15fd21c61
php-devel-4.3.2-23.ent.s390.rpm f88a6cd9638f37243f9195474b0a621c
php-imap-4.3.2-23.ent.s390.rpm 44908647a1bf7b8699004eab78641d85
php-ldap-4.3.2-23.ent.s390.rpm 061712561bf04e2177608f9723d6fd68
php-mysql-4.3.2-23.ent.s390.rpm 2578b30d28ee9248d49d559b05f79a66
php-odbc-4.3.2-23.ent.s390.rpm 0a1073d9e67bd75ad884b0c984789d8f
php-pgsql-4.3.2-23.ent.s390.rpm ce8aba6f8f7e5daebffb85f5b3917e47
s390x:
php-4.3.2-23.ent.s390x.rpm 30126ffe1094416d939a7aff262fc5ce
php-devel-4.3.2-23.ent.s390x.rpm 8dcced2d4c6a2a7c0418957852f8468b
php-imap-4.3.2-23.ent.s390x.rpm 1306bcf14591153e6cb1063c27fad644
php-ldap-4.3.2-23.ent.s390x.rpm 48e652c080759211c0b9365577a3b6b7
php-mysql-4.3.2-23.ent.s390x.rpm 41ddbec77c5d9654544291aeae04658f
php-odbc-4.3.2-23.ent.s390x.rpm 56a28dffb575117d3299e5bf3b73a106
php-pgsql-4.3.2-23.ent.s390x.rpm 39acc8cd2e58ea675485e6d7c17b54cc
x86_64:
php-4.3.2-23.ent.x86_64.rpm c65c9126a358d58c66caf072cef65ecd
php-devel-4.3.2-23.ent.x86_64.rpm c0a73dfa0b22cec4b3d1ecaaa37fc26d
php-imap-4.3.2-23.ent.x86_64.rpm ec5f608371824dc3306738f6d51c9677
php-ldap-4.3.2-23.ent.x86_64.rpm 4f4229af5ccdca0feda092dba5d50ea7
php-mysql-4.3.2-23.ent.x86_64.rpm 4e902c4400e3d472df8d5dbc6c8126d2
php-odbc-4.3.2-23.ent.x86_64.rpm 93a762b570dea3a35a8461a3ad43632c
php-pgsql-4.3.2-23.ent.x86_64.rpm be166ccd9909d1eba95d3fadc0aad6a3
Red Hat Enterprise Linux ES (v. 3)
SRPMS:
php-4.3.2-23.ent.src.rpm 58f0cca1256d18f4146f2ec006dc4fd5
IA-32:
php-4.3.2-23.ent.i386.rpm 90b3771b6440bd401c5c33d915806fc4
php-devel-4.3.2-23.ent.i386.rpm fb284c7c36219ac32f9a8adee7c13d4c
php-imap-4.3.2-23.ent.i386.rpm 6ca14b0b08f188e34e833017affe5a2e
php-ldap-4.3.2-23.ent.i386.rpm ee3952c56bc244a825035f7e7facda68
php-mysql-4.3.2-23.ent.i386.rpm bbe31e769f917c47da06b6f864bd4d0f
php-odbc-4.3.2-23.ent.i386.rpm dd9118b190805f299c24a3e3e5154cd4
php-pgsql-4.3.2-23.ent.i386.rpm 28b2599fcc44d5cff95670fd29cb49ce
IA-64:
php-4.3.2-23.ent.ia64.rpm ae30b9198b8908dd0e42e54f5cc094e5
php-devel-4.3.2-23.ent.ia64.rpm c02c359cf20fc772088e9d1df5549d8b
php-imap-4.3.2-23.ent.ia64.rpm 2506f030c45ddb1ccc6ddce44e17fc08
php-ldap-4.3.2-23.ent.ia64.rpm 0529fd8d9cbc47d16d5f3f81639b985f
php-mysql-4.3.2-23.ent.ia64.rpm f39b5fcc428e67a85d3ea91de36c0f0f
php-odbc-4.3.2-23.ent.ia64.rpm 7f72f5cca6c29fa56e71641fa60aa133
php-pgsql-4.3.2-23.ent.ia64.rpm 0df7c3e84d8b818565a30a11e5303b6d
x86_64:
php-4.3.2-23.ent.x86_64.rpm c65c9126a358d58c66caf072cef65ecd
php-devel-4.3.2-23.ent.x86_64.rpm c0a73dfa0b22cec4b3d1ecaaa37fc26d
php-imap-4.3.2-23.ent.x86_64.rpm ec5f608371824dc3306738f6d51c9677
php-ldap-4.3.2-23.ent.x86_64.rpm 4f4229af5ccdca0feda092dba5d50ea7
php-mysql-4.3.2-23.ent.x86_64.rpm 4e902c4400e3d472df8d5dbc6c8126d2
php-odbc-4.3.2-23.ent.x86_64.rpm 93a762b570dea3a35a8461a3ad43632c
php-pgsql-4.3.2-23.ent.x86_64.rpm be166ccd9909d1eba95d3fadc0aad6a3
Red Hat Enterprise Linux WS (v. 3)
SRPMS:
php-4.3.2-23.ent.src.rpm 58f0cca1256d18f4146f2ec006dc4fd5
IA-32:
php-4.3.2-23.ent.i386.rpm 90b3771b6440bd401c5c33d915806fc4
php-devel-4.3.2-23.ent.i386.rpm fb284c7c36219ac32f9a8adee7c13d4c
php-imap-4.3.2-23.ent.i386.rpm 6ca14b0b08f188e34e833017affe5a2e
php-ldap-4.3.2-23.ent.i386.rpm ee3952c56bc244a825035f7e7facda68
php-mysql-4.3.2-23.ent.i386.rpm bbe31e769f917c47da06b6f864bd4d0f
php-odbc-4.3.2-23.ent.i386.rpm dd9118b190805f299c24a3e3e5154cd4
php-pgsql-4.3.2-23.ent.i386.rpm 28b2599fcc44d5cff95670fd29cb49ce
IA-64:
php-4.3.2-23.ent.ia64.rpm ae30b9198b8908dd0e42e54f5cc094e5
php-devel-4.3.2-23.ent.ia64.rpm c02c359cf20fc772088e9d1df5549d8b
php-imap-4.3.2-23.ent.ia64.rpm 2506f030c45ddb1ccc6ddce44e17fc08
php-ldap-4.3.2-23.ent.ia64.rpm 0529fd8d9cbc47d16d5f3f81639b985f
php-mysql-4.3.2-23.ent.ia64.rpm f39b5fcc428e67a85d3ea91de36c0f0f
php-odbc-4.3.2-23.ent.ia64.rpm 7f72f5cca6c29fa56e71641fa60aa133
php-pgsql-4.3.2-23.ent.ia64.rpm 0df7c3e84d8b818565a30a11e5303b6d
x86_64:
php-4.3.2-23.ent.x86_64.rpm c65c9126a358d58c66caf072cef65ecd
php-devel-4.3.2-23.ent.x86_64.rpm c0a73dfa0b22cec4b3d1ecaaa37fc26d
php-imap-4.3.2-23.ent.x86_64.rpm ec5f608371824dc3306738f6d51c9677
php-ldap-4.3.2-23.ent.x86_64.rpm 4f4229af5ccdca0feda092dba5d50ea7
php-mysql-4.3.2-23.ent.x86_64.rpm 4e902c4400e3d472df8d5dbc6c8126d2
php-odbc-4.3.2-23.ent.x86_64.rpm 93a762b570dea3a35a8461a3ad43632c
php-pgsql-4.3.2-23.ent.x86_64.rpm be166ccd9909d1eba95d3fadc0aad6a3
(The unlinked packages above are only available from the Red Hat Network)
Bugs fixed (see bugzilla for more information)
145436 - PHP pages slow, HTTPD eating cpu
147808 - php curl open_basedir bypass
149873 - make PHP oci8 driver support Oracle Instant Client RPM
149946 - PHP GD ImageCopyMerge broken
153140 - CAN-2005-0524 PHP getimagesize() Multiple Denial of Service
Vulnerabilities CAN-2005-0525
154021 - CAN-2005-1042 PHP exif buffer overflow
154025 - CAN-2005-1043 PHP exif infinite stack recursion
References
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1392
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0524
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0525
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1042
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1043
[***** End Red Hat Security Advisory RHSA-2005:405-06 *****]
_______________________________________________________________________________
CIAC wishes to acknowledge the contributions of Red Hat for the
information contained in this bulletin.
_______________________________________________________________________________
CIAC, the Computer Incident Advisory Capability, is the computer
security incident response team for the U.S. Department of Energy
(DOE) and the emergency backup response team for the National
Institutes of Health (NIH). CIAC is located at the Lawrence Livermore
National Laboratory in Livermore, California. CIAC is also a founding
member of FIRST, the Forum of Incident Response and Security Teams, a
global organization established to foster cooperation and coordination
among computer security teams worldwide.
CIAC services are available to DOE, DOE contractors, and the NIH. CIAC
can be contacted at:
Voice: +1 925-422-8193 (7x24)
FAX: +1 925-423-8002
STU-III: +1 925-423-2604
E-mail: ciac@ciac.org
Previous CIAC notices, anti-virus software, and other information are
available from the CIAC Computer Security Archive.
World Wide Web: http://www.ciac.org/
Anonymous FTP: ftp.ciac.org
PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing
communities receive CIAC bulletins. If you are not part of these
communities, please contact your agency's response team to report
incidents. Your agency's team will coordinate with CIAC. The Forum of
Incident Response and Security Teams (FIRST) is a world-wide
organization. A list of FIRST member organizations and their
constituencies can be obtained via WWW at http://www.first.org/.
This document was prepared as an account of work sponsored by an
agency of the United States Government. Neither the United States
Government nor the University of California nor any of their
employees, makes any warranty, express or implied, or assumes any
legal liability or responsibility for the accuracy, completeness, or
usefulness of any information, apparatus, product, or process
disclosed, or represents that its use would not infringe privately
owned rights. Reference herein to any specific commercial products,
process, or service by trade name, trademark, manufacturer, or
otherwise, does not necessarily constitute or imply its endorsement,
recommendation or favoring by the United States Government or the
University of California. The views and opinions of authors expressed
herein do not necessarily state or reflect those of the United States
Government or the University of California, and shall not be used for
advertising or product endorsement purposes.
LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC)
P-187: Sun Java System Web Proxy Server Vulnerability
P-188: Security Vulnerabilities Addressed in Red Hat Kernel Update
P-189: RealNetworks Releases Security Updates
P-190: Firefox Security Bugs
P-191: KDE Image File Format Reader Vulnerabilities
P-192: OpenOffice.org Buffer Overflow Vulnerability
P-193: Mozilla Security Bugs
P-194: Buffer Overflow in “sharutils”
P-195: CVS Vulnerabilities
P-196: HP OpenView Radia Management Portal and Agent Vulnerability