SecurityTracker: (Apple Issues Fix) PHP Calculation Error in init_request_info() May Let Remote Users Execute Arbitrary Code

	Keep Track of the Latest Vulnerabilities with SecurityTracker!

SecurityTracker Alert ID: 1020593

SecurityTracker URL: http://securitytracker.com/id/1020593

CVE Reference: CVE-2008-0599 (Links to External Site)

Date: Aug 1 2008

Impact: Execution of arbitrary code via network, User access via network

Fix Available: Yes Vendor Confirmed: Yes

Version(s): prior to 5.2.6

Description: A vulnerability was reported in PHP. A remote user may be able to execute arbitrary code on the target system.

The init_request_info() function in 'sapi/cgi/cgi_main.c' incorrectly calculates the length of PATH_TRANSLATED. A remote user may be able to submit a specially crafted URL to execute arbitrary code on the target system.

Ryan Permeh reported this vulnerability.

Impact: A remote user may be able to execute arbitrary code on the target system.

Solution: Apple has issued a fix (Security Update 2008-005), which can be downloaded and installed via Software Update preferences, or from Apple Downloads at:

http://www.apple.com/support/downloads/

The Apple advisory is available at:

http://support.apple.com/kb/HT2647

Vendor URL: www.php.net/releases/5_2_6.php (Links to External Site)

Cause: State error

Underlying OS: UNIX (OS X)

Message History: This archive entry is a follow-up to the message listed below.


[Original Message Not Available for Viewing]