USN-549-1: PHP vulnerabilities

29 November 2007

php5 vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 7.10
  • Ubuntu 7.04
  • Ubuntu 6.10
  • Ubuntu 6.06 LTS

Software Description

  • php5

Details

It was discovered that the wordwrap function did not correctly check lengths. Remote attackers could exploit this to cause a crash or monopolize CPU resources, resulting in a denial of service. (CVE-2007-3998)

Integer overflows were discovered in the strspn and strcspn functions. Attackers could exploit this to read arbitrary areas of memory, possibly gaining access to sensitive information. (CVE-2007-4657)

Stanislav Malyshev discovered that money_format function did not correctly handle certain tokens. If a PHP application were tricked into processing a bad format string, a remote attacker could execute arbitrary code with application privileges. (CVE-2007-4658)

It was discovered that the php_openssl_make_REQ function did not correctly check buffer lengths. A remote attacker could send a specially crafted message and execute arbitrary code with application privileges. (CVE-2007-4662)

It was discovered that certain characters in session cookies were not handled correctly. A remote attacker could injection values which could lead to altered application behavior, potentially gaining additional privileges. (CVE-2007-3799)

Gerhard Wagner discovered that the chunk_split function did not correctly handle long strings. A remote attacker could exploit this to execute arbitrary code with application privileges. (CVE-2007-2872, CVE-2007-4660, CVE-2007-4661)

Stefan Esser discovered that deeply nested arrays could be made to fill stack space. A remote attacker could exploit this to cause a crash or monopolize CPU resources, resulting in a denial of service. (CVE-2007-1285, CVE-2007-4670)

Rasmus Lerdorf discovered that the htmlentities and htmlspecialchars functions did not correctly stop when handling partial multibyte sequences. A remote attacker could exploit this to read certain areas of memory, possibly gaining access to sensitive information. (CVE-2007-5898)

It was discovered that the output_add_rewrite_var fucntion would sometimes leak session id information to forms targeting remote URLs. Malicious remote sites could use this information to gain access to a PHP application user’s login credentials. (CVE-2007-5899)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 7.10
libapache2-mod-php5 - 5.2.3-1ubuntu6.1
php5-cgi - 5.2.3-1ubuntu6.1
php5-cli - 5.2.3-1ubuntu6.1
Ubuntu 7.04
libapache2-mod-php5 - 5.2.1-0ubuntu1.5
php5-cgi - 5.2.1-0ubuntu1.5
php5-cli - 5.2.1-0ubuntu1.5
Ubuntu 6.10
libapache2-mod-php5 - 5.1.6-1ubuntu2.7
php5-cgi - 5.1.6-1ubuntu2.7
php5-cli - 5.1.6-1ubuntu2.7
Ubuntu 6.06 LTS
libapache2-mod-php5 - 5.1.2-1ubuntu3.10
php5-cgi - 5.1.2-1ubuntu3.10
php5-cli - 5.1.2-1ubuntu3.10

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system upgrade is sufficient to effect the necessary changes.

References