SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   PHP Vendors:   PHP Group
(Red Hat Issues Fix) PHP Buffer Overflows and Format String Bugs Permit Code Execution and Denial of Service
SecurityTracker Alert ID:  1017679
SecurityTracker URL:  http://securitytracker.com/id/1017679
CVE Reference:   CVE-2007-0906, CVE-2007-0907, CVE-2007-0908, CVE-2007-0909, CVE-2007-0910, CVE-2007-0988   (Links to External Site)
Date:  Feb 21 2007
Impact:   Denial of service via local system, Denial of service via network, Execution of arbitrary code via local system, Execution of arbitrary code via network, User access via local system, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): prior to 5.2.1
Description:   Several vulnerabilities were reported in PHP. A remote or local user may be able to execute arbitrary code on the target system or cause denial of service conditions.

Several buffer overflows exist in some PHP functions [CVE-2007-0906]. The PHP session extension, the str_replace() function, and the imap_mail_compose() functions are affected. A remote user may be able to submit specially crafted values to a program that uses the affected function to trigger an overflow and execute arbitrary code.

A buffer underflow in the sapi_header_op() function may let users cause denial of service conditions [CVE-2007-0907].

The wddx extension can be exploited using certain WDDX input packets to view random portions of heap memory [CVE-2007-0908].

A remote user under control of a database table accessed via the odbc_result_all() function can supply specially crafted data to trigger a format string flaw and execute arbitrary code [CVE-2007-0909].

Unspecified vulnerabilities may allow a user to overwrite certain super-global variables [CVE-2007-0910].

A user can supply specially crafted data to the zend_hash_init() function to cause the function to enter an infinite loop and consume excessive CPU resources until a timeout is reached [CVE-2007-0988].

Impact:   A remote or local user may be able to execute arbitrary code on the target system.

A remote or local user may be able to cause denial of service conditions.

The specific impact depends on the applications using PHP.

Solution:   Red Hat has released a fix.

The Red Hat advisory is available at:

https://rhn.redhat.com/errata/RHSA-2007-0081.html

Vendor URL:  www.php.net/releases/5_2_1.php (Links to External Site)
Cause:   Boundary error, Input validation error, State error
Underlying OS:  Linux (Red Hat Enterprise)
Underlying OS Comments:  2.1

Message History:   This archive entry is a follow-up to the message listed below.
Feb 20 2007 PHP Buffer Overflows and Format String Bugs Permit Code Execution and Denial of Service



 Source Message Contents

Subject:  [RHSA-2007:0081-01] Important: php security update


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ---------------------------------------------------------------------
                   Red Hat Security Advisory

Synopsis:          Important: php security update
Advisory ID:       RHSA-2007:0081-01
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2007-0081.html
Issue date:        2007-02-21
Updated on:        2007-02-21
Product:           Red Hat Enterprise Linux
CVE Names:         CVE-2007-0906 CVE-2007-0907 CVE-2007-0908 
                   CVE-2007-0909 CVE-2007-0910 CVE-2007-0988 
- ---------------------------------------------------------------------

1. Summary:

Updated PHP packages that fix several security issues are now available for
Red Hat Enterprise Linux 2.1.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386, ia64
Red Hat Linux Advanced Workstation 2.1 - ia64
Red Hat Enterprise Linux ES version 2.1 - i386
Red Hat Enterprise Linux WS version 2.1 - i386

3. Problem description:

PHP is an HTML-embedded scripting language commonly used with the Apache
HTTP Web server. 

A number of buffer overflow flaws were found in the PHP session extension;
the str_replace() function; and the imap_mail_compose() function. If very
long strings were passed to the str_replace() function, an integer
overflow could occur in memory allocation. If a script used the
imap_mail_compose() function to create a new MIME message based on an
input body from an untrusted source, it could result in a heap overflow.
An attacker with access to a PHP application affected by any these issues
could trigger the flaws and possibly execute arbitrary code as the
'apache' user. (CVE-2007-0906)

When unserializing untrusted data on 64-bit platforms, the
zend_hash_init() function could be forced into an infinite loop, consuming
CPU resources for a limited time, until the script timeout alarm aborted
execution of the script. (CVE-2007-0988)

If the wddx extension was used to import WDDX data from an untrusted
source, certain WDDX input packets could expose a random portion of heap
memory. (CVE-2007-0908)

If the odbc_result_all() function was used to display data from a database,
and the database table contents were under an attacker's control, a format
string vulnerability was possible which could allow arbitrary code
execution. (CVE-2007-0909)

A one byte memory read always occurs before the beginning of a buffer. This
could be triggered, for example, by any use of the header() function in a
script. However it is unlikely that this would have any effect.
(CVE-2007-0907)

Several flaws in PHP could allow attackers to "clobber" certain
super-global variables via unspecified vectors. (CVE-2007-0910)

Users of PHP should upgrade to these updated packages which contain
backported patches to correct these issues.

Red Hat would like to thank Stefan Esser for his help diagnosing these issues.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via Red Hat Network.  To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

5. Bug IDs fixed (http://bugzilla.redhat.com/):

229332 - CVE-2007-0906 PHP security issues (CVE-2007-0907, CVE-2007-0908, CVE-2007-0909,  CVE-2007-0910, CVE-2007-0988)

6. RPMs required:

Red Hat Enterprise Linux AS (Advanced Server) version 2.1:

SRPMS:
ftp://updates.redhat.com/enterprise/2.1AS/en/os/SRPMS/php-4.1.2-2.14.src.rpm
3c1babd0b650d968fb05c3fc941e1328  php-4.1.2-2.14.src.rpm

i386:
a4e8107d7d04c391924e1a489c4e8b1f  php-4.1.2-2.14.i386.rpm
3eb84ba09f48aafdd82fd273847c0ab7  php-devel-4.1.2-2.14.i386.rpm
547ee3ef9a42650b7968ca5d847cb362  php-imap-4.1.2-2.14.i386.rpm
27ad3782dd0bd6c398f6759c615a7a8e  php-ldap-4.1.2-2.14.i386.rpm
8f5cb33e88ebc83c80fd69608daa943b  php-manual-4.1.2-2.14.i386.rpm
13f14591befae51d6c2072e29190510e  php-mysql-4.1.2-2.14.i386.rpm
3c5a5d6027e2f960091044d63205e00b  php-odbc-4.1.2-2.14.i386.rpm
b14c7e1d15965c39febb475897ec9602  php-pgsql-4.1.2-2.14.i386.rpm

ia64:
e62f6a7585c07440f283543af205720c  php-4.1.2-2.14.ia64.rpm
ddb2e7b85468f5c222ba1f09fcfdad9c  php-devel-4.1.2-2.14.ia64.rpm
b8f556303277dc3847d24acff42d530f  php-imap-4.1.2-2.14.ia64.rpm
444ae771d27b6eb5a4b9fc20df23ee46  php-ldap-4.1.2-2.14.ia64.rpm
d95de85e804a28dfbf0e1cf2dee9b184  php-manual-4.1.2-2.14.ia64.rpm
5e8f596c3109b090b1de0b40faa3575c  php-mysql-4.1.2-2.14.ia64.rpm
b017004385456310eaf7108b5e48a1fd  php-odbc-4.1.2-2.14.ia64.rpm
2b0984f7324d18f6f605b16ab0e0bcc1  php-pgsql-4.1.2-2.14.ia64.rpm

Red Hat Linux Advanced Workstation 2.1:

SRPMS:
ftp://updates.redhat.com/enterprise/2.1AW/en/os/SRPMS/php-4.1.2-2.14.src.rpm
3c1babd0b650d968fb05c3fc941e1328  php-4.1.2-2.14.src.rpm

ia64:
e62f6a7585c07440f283543af205720c  php-4.1.2-2.14.ia64.rpm
ddb2e7b85468f5c222ba1f09fcfdad9c  php-devel-4.1.2-2.14.ia64.rpm
b8f556303277dc3847d24acff42d530f  php-imap-4.1.2-2.14.ia64.rpm
444ae771d27b6eb5a4b9fc20df23ee46  php-ldap-4.1.2-2.14.ia64.rpm
d95de85e804a28dfbf0e1cf2dee9b184  php-manual-4.1.2-2.14.ia64.rpm
5e8f596c3109b090b1de0b40faa3575c  php-mysql-4.1.2-2.14.ia64.rpm
b017004385456310eaf7108b5e48a1fd  php-odbc-4.1.2-2.14.ia64.rpm
2b0984f7324d18f6f605b16ab0e0bcc1  php-pgsql-4.1.2-2.14.ia64.rpm

Red Hat Enterprise Linux ES version 2.1:

SRPMS:
ftp://updates.redhat.com/enterprise/2.1ES/en/os/SRPMS/php-4.1.2-2.14.src.rpm
3c1babd0b650d968fb05c3fc941e1328  php-4.1.2-2.14.src.rpm

i386:
a4e8107d7d04c391924e1a489c4e8b1f  php-4.1.2-2.14.i386.rpm
3eb84ba09f48aafdd82fd273847c0ab7  php-devel-4.1.2-2.14.i386.rpm
547ee3ef9a42650b7968ca5d847cb362  php-imap-4.1.2-2.14.i386.rpm
27ad3782dd0bd6c398f6759c615a7a8e  php-ldap-4.1.2-2.14.i386.rpm
8f5cb33e88ebc83c80fd69608daa943b  php-manual-4.1.2-2.14.i386.rpm
13f14591befae51d6c2072e29190510e  php-mysql-4.1.2-2.14.i386.rpm
3c5a5d6027e2f960091044d63205e00b  php-odbc-4.1.2-2.14.i386.rpm
b14c7e1d15965c39febb475897ec9602  php-pgsql-4.1.2-2.14.i386.rpm

Red Hat Enterprise Linux WS version 2.1:

SRPMS:
ftp://updates.redhat.com/enterprise/2.1WS/en/os/SRPMS/php-4.1.2-2.14.src.rpm
3c1babd0b650d968fb05c3fc941e1328  php-4.1.2-2.14.src.rpm

i386:
a4e8107d7d04c391924e1a489c4e8b1f  php-4.1.2-2.14.i386.rpm
3eb84ba09f48aafdd82fd273847c0ab7  php-devel-4.1.2-2.14.i386.rpm
547ee3ef9a42650b7968ca5d847cb362  php-imap-4.1.2-2.14.i386.rpm
27ad3782dd0bd6c398f6759c615a7a8e  php-ldap-4.1.2-2.14.i386.rpm
8f5cb33e88ebc83c80fd69608daa943b  php-manual-4.1.2-2.14.i386.rpm
13f14591befae51d6c2072e29190510e  php-mysql-4.1.2-2.14.i386.rpm
3c5a5d6027e2f960091044d63205e00b  php-odbc-4.1.2-2.14.i386.rpm
b14c7e1d15965c39febb475897ec9602  php-pgsql-4.1.2-2.14.i386.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0906
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0907
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0908
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0909
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0910
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0988
http://www.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>.  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2007 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFF3D69XlSAg2UNWIIRAsjOAKCrC1uXzG5muVKFx77qJoxZRY7hWwCfY+0D
3QvYMxpASUIPkt1TLv7kc4c=
=W5Yx
-----END PGP SIGNATURE-----



-- 
Enterprise-watch-list mailing list
Enterprise-watch-list@redhat.com
https://www.redhat.com/mailman/listinfo/enterprise-watch-list

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2022, SecurityGlobal.net LLC