__________________________________________________________ The U.S. Department of Energy Computer Incident Advisory Capability ___ __ __ _ ___ / | /_\ / \___ __|__ / \ \___ __________________________________________________________ INFORMATION BULLETIN PHP Security Bugs [Red Hat Security Advisory RHSA-2005:405-06] April 29, 2005 17:00 GMT Number P-197 [REVISED 04 May 2005] [REVISED 09 May 2005] [REVISED 26 May 2005] ______________________________________________________________________________ PROBLEM: Various security related bugs were discovered in PHP, an HTML-embedded scripting language commonly used with the Apache HTTP Web server. PLATFORM: Red Hat Desktop (v. 3, 4) Red Hat Enterprise Linux AS (v. 3, 4) Red Hat Enterprise Linux ES (v. 3, 4) Red Hat Enterprise Linux WS (v. 3, 4) SGI ProPack 3 Service Pack 5 for SGI Altix family of systems Debian GNU/Linux 3.0 alias woody DAMAGE: Several security vulnerabilities were addressed, including a bug in the cURL extension that may allow remote attackers to read arbitrary files via a file: URL argument to the curl_init function. SOLUTION: Apply available security updates. ______________________________________________________________________________ VULNERABILITY The risk is LOW. Exploiting this vulnerability may lead to ASSESSMENT: disclosure of sensitive information. ______________________________________________________________________________ LINKS: CIAC BULLETIN: http://www.ciac.org/ciac/bulletins/p-197.shtml ORIGINAL BULLETIN: https://rhn.redhat.com/errata/RHSA-2005-405.html ADDITIONAL LINKS: Red Hat Security Advisory RHSA-2005:406-11 https://rhn.redhat.com/errata/RHSA-2005-406.html SGI Security Advisory Number 20050501-01-U ftp://patches.sgi.com/support/free/security/advisories/20050501-01-U.asc Debian Security Advisory DSA-729-1 http://www.debian.org/security/2005/dsa-729 CVE/CAN: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name= CAN-2004-1392 CAN-2005-0524 CAN-2005-0525 CAN-2005-1042 CAN-2005-1043 ______________________________________________________________________________ REVISION HISTORY: 05/05/05 - Red Hat added fixes for Red Hat Desktop (v.4), Red Hat Enterprise Linux AS (v.4), Red Hat Enterprise Linux ES (v.4), and Red Hat Enterprise Linux WS (v.4). 05/09/05 - added a link to SGI Security Advisory 20050501-01-U. 05/26/05 - added a link to Debian Security Advisory DSA-729-1 for Debian GNU/Linux 3.0 alias woody. [***** Start Red Hat Security Advisory RHSA-2005:405-06 *****] Moderate: PHP security update Advisory: RHSA-2005:405-06 Type: Security Advisory Issued on: 2005-04-28 Last updated on: 2005-04-28 Affected Products: Red Hat Desktop (v. 3) Red Hat Enterprise Linux AS (v. 3) Red Hat Enterprise Linux ES (v. 3) Red Hat Enterprise Linux WS (v. 3) CVEs (cve.mitre.org): CAN-2004-1392 CAN-2005-0524 CAN-2005-0525 CAN-2005-1042 CAN-2005-1043 Details Updated PHP packages that fix various security issues are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server. A bug was found in the way PHP processes IFF and JPEG images. It is possible to cause PHP to consume CPU resources for a short period of time by supplying a carefully crafted IFF or JPEG image. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CAN-2005-0524 and CAN-2005-0525 to these issues. A buffer overflow bug was also found in the way PHP processes EXIF image headers. It is possible for an attacker to construct an image file in such a way that it could execute arbitrary instructions when processed by PHP. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-1042 to this issue. A denial of service bug was found in the way PHP processes EXIF image headers. It is possible for an attacker to cause PHP to enter an infinite loop for a short period of time by supplying a carefully crafted image file to PHP for processing. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-1043 to this issue. Several bug fixes are also included in this update: - The security fixes in RHSA-2004-687 to the "unserializer" code introduced some performance issues. - In the gd extension, the "imagecopymerge" function did not correctly handle transparency. The original image was being obscured in the resultant image. - In the curl extension, safe mode was not enforced for 'file:///' URL lookups (CAN-2004-1392). Users of PHP should upgrade to these updated packages, which contain backported fixes for these issues. Solution Before applying this update, make sure that all previously-released errata relevant to your system have been applied. Use Red Hat Network to download and update your packages. To launch the Red Hat Update Agent, use the following command: up2date For information on how to install packages manually, refer to the following Web page for the System Administration or Customization guide specific to your system: http://www.redhat.com/docs/manuals/enterprise/ Updated packages Red Hat Desktop (v. 3) SRPMS: php-4.3.2-23.ent.src.rpm 58f0cca1256d18f4146f2ec006dc4fd5 IA-32: php-4.3.2-23.ent.i386.rpm 90b3771b6440bd401c5c33d915806fc4 php-devel-4.3.2-23.ent.i386.rpm fb284c7c36219ac32f9a8adee7c13d4c php-imap-4.3.2-23.ent.i386.rpm 6ca14b0b08f188e34e833017affe5a2e php-ldap-4.3.2-23.ent.i386.rpm ee3952c56bc244a825035f7e7facda68 php-mysql-4.3.2-23.ent.i386.rpm bbe31e769f917c47da06b6f864bd4d0f php-odbc-4.3.2-23.ent.i386.rpm dd9118b190805f299c24a3e3e5154cd4 php-pgsql-4.3.2-23.ent.i386.rpm 28b2599fcc44d5cff95670fd29cb49ce x86_64: php-4.3.2-23.ent.x86_64.rpm c65c9126a358d58c66caf072cef65ecd php-devel-4.3.2-23.ent.x86_64.rpm c0a73dfa0b22cec4b3d1ecaaa37fc26d php-imap-4.3.2-23.ent.x86_64.rpm ec5f608371824dc3306738f6d51c9677 php-ldap-4.3.2-23.ent.x86_64.rpm 4f4229af5ccdca0feda092dba5d50ea7 php-mysql-4.3.2-23.ent.x86_64.rpm 4e902c4400e3d472df8d5dbc6c8126d2 php-odbc-4.3.2-23.ent.x86_64.rpm 93a762b570dea3a35a8461a3ad43632c php-pgsql-4.3.2-23.ent.x86_64.rpm be166ccd9909d1eba95d3fadc0aad6a3 Red Hat Enterprise Linux AS (v. 3) SRPMS: php-4.3.2-23.ent.src.rpm 58f0cca1256d18f4146f2ec006dc4fd5 IA-32: php-4.3.2-23.ent.i386.rpm 90b3771b6440bd401c5c33d915806fc4 php-devel-4.3.2-23.ent.i386.rpm fb284c7c36219ac32f9a8adee7c13d4c php-imap-4.3.2-23.ent.i386.rpm 6ca14b0b08f188e34e833017affe5a2e php-ldap-4.3.2-23.ent.i386.rpm ee3952c56bc244a825035f7e7facda68 php-mysql-4.3.2-23.ent.i386.rpm bbe31e769f917c47da06b6f864bd4d0f php-odbc-4.3.2-23.ent.i386.rpm dd9118b190805f299c24a3e3e5154cd4 php-pgsql-4.3.2-23.ent.i386.rpm 28b2599fcc44d5cff95670fd29cb49ce IA-64: php-4.3.2-23.ent.ia64.rpm ae30b9198b8908dd0e42e54f5cc094e5 php-devel-4.3.2-23.ent.ia64.rpm c02c359cf20fc772088e9d1df5549d8b php-imap-4.3.2-23.ent.ia64.rpm 2506f030c45ddb1ccc6ddce44e17fc08 php-ldap-4.3.2-23.ent.ia64.rpm 0529fd8d9cbc47d16d5f3f81639b985f php-mysql-4.3.2-23.ent.ia64.rpm f39b5fcc428e67a85d3ea91de36c0f0f php-odbc-4.3.2-23.ent.ia64.rpm 7f72f5cca6c29fa56e71641fa60aa133 php-pgsql-4.3.2-23.ent.ia64.rpm 0df7c3e84d8b818565a30a11e5303b6d PPC: php-4.3.2-23.ent.ppc.rpm 1d106837f13833934d36cd40b1656a31 php-devel-4.3.2-23.ent.ppc.rpm 3a490c937d75c426adad35e2a28f308d php-imap-4.3.2-23.ent.ppc.rpm 048861f82d2596f722bd1af0edb43e2c php-ldap-4.3.2-23.ent.ppc.rpm 48838c0212c8647f4e13f0a8bd13924b php-mysql-4.3.2-23.ent.ppc.rpm 8d414fd1c5cc0b8f847d2aec8a7c5cdd php-odbc-4.3.2-23.ent.ppc.rpm de5cccba75b024dc074b0e532cc8da62 php-pgsql-4.3.2-23.ent.ppc.rpm 33c39c6dde048b7ee2b86ffd00cca63b s390: php-4.3.2-23.ent.s390.rpm de50da7e22ae20bcc603c5a15fd21c61 php-devel-4.3.2-23.ent.s390.rpm f88a6cd9638f37243f9195474b0a621c php-imap-4.3.2-23.ent.s390.rpm 44908647a1bf7b8699004eab78641d85 php-ldap-4.3.2-23.ent.s390.rpm 061712561bf04e2177608f9723d6fd68 php-mysql-4.3.2-23.ent.s390.rpm 2578b30d28ee9248d49d559b05f79a66 php-odbc-4.3.2-23.ent.s390.rpm 0a1073d9e67bd75ad884b0c984789d8f php-pgsql-4.3.2-23.ent.s390.rpm ce8aba6f8f7e5daebffb85f5b3917e47 s390x: php-4.3.2-23.ent.s390x.rpm 30126ffe1094416d939a7aff262fc5ce php-devel-4.3.2-23.ent.s390x.rpm 8dcced2d4c6a2a7c0418957852f8468b php-imap-4.3.2-23.ent.s390x.rpm 1306bcf14591153e6cb1063c27fad644 php-ldap-4.3.2-23.ent.s390x.rpm 48e652c080759211c0b9365577a3b6b7 php-mysql-4.3.2-23.ent.s390x.rpm 41ddbec77c5d9654544291aeae04658f php-odbc-4.3.2-23.ent.s390x.rpm 56a28dffb575117d3299e5bf3b73a106 php-pgsql-4.3.2-23.ent.s390x.rpm 39acc8cd2e58ea675485e6d7c17b54cc x86_64: php-4.3.2-23.ent.x86_64.rpm c65c9126a358d58c66caf072cef65ecd php-devel-4.3.2-23.ent.x86_64.rpm c0a73dfa0b22cec4b3d1ecaaa37fc26d php-imap-4.3.2-23.ent.x86_64.rpm ec5f608371824dc3306738f6d51c9677 php-ldap-4.3.2-23.ent.x86_64.rpm 4f4229af5ccdca0feda092dba5d50ea7 php-mysql-4.3.2-23.ent.x86_64.rpm 4e902c4400e3d472df8d5dbc6c8126d2 php-odbc-4.3.2-23.ent.x86_64.rpm 93a762b570dea3a35a8461a3ad43632c php-pgsql-4.3.2-23.ent.x86_64.rpm be166ccd9909d1eba95d3fadc0aad6a3 Red Hat Enterprise Linux ES (v. 3) SRPMS: php-4.3.2-23.ent.src.rpm 58f0cca1256d18f4146f2ec006dc4fd5 IA-32: php-4.3.2-23.ent.i386.rpm 90b3771b6440bd401c5c33d915806fc4 php-devel-4.3.2-23.ent.i386.rpm fb284c7c36219ac32f9a8adee7c13d4c php-imap-4.3.2-23.ent.i386.rpm 6ca14b0b08f188e34e833017affe5a2e php-ldap-4.3.2-23.ent.i386.rpm ee3952c56bc244a825035f7e7facda68 php-mysql-4.3.2-23.ent.i386.rpm bbe31e769f917c47da06b6f864bd4d0f php-odbc-4.3.2-23.ent.i386.rpm dd9118b190805f299c24a3e3e5154cd4 php-pgsql-4.3.2-23.ent.i386.rpm 28b2599fcc44d5cff95670fd29cb49ce IA-64: php-4.3.2-23.ent.ia64.rpm ae30b9198b8908dd0e42e54f5cc094e5 php-devel-4.3.2-23.ent.ia64.rpm c02c359cf20fc772088e9d1df5549d8b php-imap-4.3.2-23.ent.ia64.rpm 2506f030c45ddb1ccc6ddce44e17fc08 php-ldap-4.3.2-23.ent.ia64.rpm 0529fd8d9cbc47d16d5f3f81639b985f php-mysql-4.3.2-23.ent.ia64.rpm f39b5fcc428e67a85d3ea91de36c0f0f php-odbc-4.3.2-23.ent.ia64.rpm 7f72f5cca6c29fa56e71641fa60aa133 php-pgsql-4.3.2-23.ent.ia64.rpm 0df7c3e84d8b818565a30a11e5303b6d x86_64: php-4.3.2-23.ent.x86_64.rpm c65c9126a358d58c66caf072cef65ecd php-devel-4.3.2-23.ent.x86_64.rpm c0a73dfa0b22cec4b3d1ecaaa37fc26d php-imap-4.3.2-23.ent.x86_64.rpm ec5f608371824dc3306738f6d51c9677 php-ldap-4.3.2-23.ent.x86_64.rpm 4f4229af5ccdca0feda092dba5d50ea7 php-mysql-4.3.2-23.ent.x86_64.rpm 4e902c4400e3d472df8d5dbc6c8126d2 php-odbc-4.3.2-23.ent.x86_64.rpm 93a762b570dea3a35a8461a3ad43632c php-pgsql-4.3.2-23.ent.x86_64.rpm be166ccd9909d1eba95d3fadc0aad6a3 Red Hat Enterprise Linux WS (v. 3) SRPMS: php-4.3.2-23.ent.src.rpm 58f0cca1256d18f4146f2ec006dc4fd5 IA-32: php-4.3.2-23.ent.i386.rpm 90b3771b6440bd401c5c33d915806fc4 php-devel-4.3.2-23.ent.i386.rpm fb284c7c36219ac32f9a8adee7c13d4c php-imap-4.3.2-23.ent.i386.rpm 6ca14b0b08f188e34e833017affe5a2e php-ldap-4.3.2-23.ent.i386.rpm ee3952c56bc244a825035f7e7facda68 php-mysql-4.3.2-23.ent.i386.rpm bbe31e769f917c47da06b6f864bd4d0f php-odbc-4.3.2-23.ent.i386.rpm dd9118b190805f299c24a3e3e5154cd4 php-pgsql-4.3.2-23.ent.i386.rpm 28b2599fcc44d5cff95670fd29cb49ce IA-64: php-4.3.2-23.ent.ia64.rpm ae30b9198b8908dd0e42e54f5cc094e5 php-devel-4.3.2-23.ent.ia64.rpm c02c359cf20fc772088e9d1df5549d8b php-imap-4.3.2-23.ent.ia64.rpm 2506f030c45ddb1ccc6ddce44e17fc08 php-ldap-4.3.2-23.ent.ia64.rpm 0529fd8d9cbc47d16d5f3f81639b985f php-mysql-4.3.2-23.ent.ia64.rpm f39b5fcc428e67a85d3ea91de36c0f0f php-odbc-4.3.2-23.ent.ia64.rpm 7f72f5cca6c29fa56e71641fa60aa133 php-pgsql-4.3.2-23.ent.ia64.rpm 0df7c3e84d8b818565a30a11e5303b6d x86_64: php-4.3.2-23.ent.x86_64.rpm c65c9126a358d58c66caf072cef65ecd php-devel-4.3.2-23.ent.x86_64.rpm c0a73dfa0b22cec4b3d1ecaaa37fc26d php-imap-4.3.2-23.ent.x86_64.rpm ec5f608371824dc3306738f6d51c9677 php-ldap-4.3.2-23.ent.x86_64.rpm 4f4229af5ccdca0feda092dba5d50ea7 php-mysql-4.3.2-23.ent.x86_64.rpm 4e902c4400e3d472df8d5dbc6c8126d2 php-odbc-4.3.2-23.ent.x86_64.rpm 93a762b570dea3a35a8461a3ad43632c php-pgsql-4.3.2-23.ent.x86_64.rpm be166ccd9909d1eba95d3fadc0aad6a3 (The unlinked packages above are only available from the Red Hat Network) Bugs fixed (see bugzilla for more information) 145436 - PHP pages slow, HTTPD eating cpu 147808 - php curl open_basedir bypass 149873 - make PHP oci8 driver support Oracle Instant Client RPM 149946 - PHP GD ImageCopyMerge broken 153140 - CAN-2005-0524 PHP getimagesize() Multiple Denial of Service Vulnerabilities CAN-2005-0525 154021 - CAN-2005-1042 PHP exif buffer overflow 154025 - CAN-2005-1043 PHP exif infinite stack recursion References http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1392 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0524 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0525 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1042 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1043 [***** End Red Hat Security Advisory RHSA-2005:405-06 *****] _______________________________________________________________________________ CIAC wishes to acknowledge the contributions of Red Hat for the information contained in this bulletin. _______________________________________________________________________________ CIAC, the Computer Incident Advisory Capability, is the computer security incident response team for the U.S. Department of Energy (DOE) and the emergency backup response team for the National Institutes of Health (NIH). CIAC is located at the Lawrence Livermore National Laboratory in Livermore, California. CIAC is also a founding member of FIRST, the Forum of Incident Response and Security Teams, a global organization established to foster cooperation and coordination among computer security teams worldwide. CIAC services are available to DOE, DOE contractors, and the NIH. CIAC can be contacted at: Voice: +1 925-422-8193 (7x24) FAX: +1 925-423-8002 STU-III: +1 925-423-2604 E-mail: ciac@ciac.org Previous CIAC notices, anti-virus software, and other information are available from the CIAC Computer Security Archive. World Wide Web: http://www.ciac.org/ Anonymous FTP: ftp.ciac.org PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing communities receive CIAC bulletins. If you are not part of these communities, please contact your agency's response team to report incidents. Your agency's team will coordinate with CIAC. The Forum of Incident Response and Security Teams (FIRST) is a world-wide organization. A list of FIRST member organizations and their constituencies can be obtained via WWW at http://www.first.org/. This document was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government nor the University of California nor any of their employees, makes any warranty, express or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, apparatus, product, or process disclosed, or represents that its use would not infringe privately owned rights. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation or favoring by the United States Government or the University of California. The views and opinions of authors expressed herein do not necessarily state or reflect those of the United States Government or the University of California, and shall not be used for advertising or product endorsement purposes. LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC) P-187: Sun Java System Web Proxy Server Vulnerability P-188: Security Vulnerabilities Addressed in Red Hat Kernel Update P-189: RealNetworks Releases Security Updates P-190: Firefox Security Bugs P-191: KDE Image File Format Reader Vulnerabilities P-192: OpenOffice.org Buffer Overflow Vulnerability P-193: Mozilla Security Bugs P-194: Buffer Overflow in “sharutils” P-195: CVS Vulnerabilities P-196: HP OpenView Radia Management Portal and Agent Vulnerability