Fwd: CERT Advisory CA-2002-05 Multiple Vulnerabilities in PHP
fileupload
Robin Boulton
rboulton at linc.lib.il.us
Thu Feb 28 10:07:19 EST 2002
I am forwarding this because I know that PHP is becoming quite widely used
in library environments. If any of you are involved with servers running
PHP I strongly urge you to apply the patch and subscribe to this newsletter
if you are not already.
Apologies for cross-posting, and also if this is considered too far off topic.
>Date: Wed, 27 Feb 2002 16:53:31 -0500 (EST)
>From: CERT Advisory <cert-advisory at cert.org>
>To: cert-advisory at cert.org
>Organization: CERT(R) Coordination Center - +1 412-268-7090
>List-Help: <http://www.cert.org/>, <mailto:Majordomo at cert.org?body=help>
>List-Subscribe: <mailto:Majordomo at cert.org?body=subscribe%20cert-advisory>
>List-Unsubscribe: <mailto:Majordomo at cert.org?body=unsubscribe%20cert-advisory>
>List-Post: NO (posting not allowed on this list)
>List-Owner: <mailto:cert-advisory-owner at cert.org>
>List-Archive: <http://www.cert.org/>
>Subject: CERT Advisory CA-2002-05 Multiple Vulnerabilities in PHP fileupload
>
>
>
>-----BEGIN PGP SIGNED MESSAGE-----
>
>CERT Advisory CA-2002-05 Multiple Vulnerabilities in PHP fileupload
>
> Original release date: February 27, 2002
> Last revised: --
> Source: CERT/CC
>
> A complete revision history can be found at the end of this file.
>
>Systems Affected
>
> * Web servers running PHP
>
>Overview
>
> Multiple vulnerabilities exist in the PHP scripting language. These
> vulnerabilities could allow a remote attacker to execute arbitrary
> code with the privileges of the PHP process.
>
>I. Description
>
> PHP is a scripting language widely used in web development. PHP can be
> installed on a variety of web servers, including Apache, IIS, Caudium,
> Netscape and iPlanet, OmniHTTPd and others. Vulnerabilities in the
> php_mime_split function may allow an intruder to execute arbitrary
> code with the privileges of the web server. For additional details,
> see
>
> http://security.e-matters.de/advisories/012002.html
>
> Web servers that do not have PHP installed are not affected by this
> vulnerability.
>
> The CERT/CC is tracking this set of vulnerabilities as VU#297363. At
> this time, these vulnerabilities have not been assigned a CVE
> identifier.
>
>II. Impact
>
> Intruders can execute arbitrary code with the privileges of the web
> server, or interrupt normal operations of the web server.
>
>III. Solution
>
>Apply a Patch
>
> Upgrade to PHP version 4.1.2, available from
>
> http://www.php.net/do_download.php?download_file=php-4.1.2.tar.gz
>
> If upgrading is not possible, apply patches as described at
> http://www.php.net/downloads.php:
> * For PHP 4.10/4.11
> http://www.php.net/do_download.php?download_file=rfc1867.c.diff-4.1.x.gz
> * For PHP 4.06
> http://www.php.net/do_download.php?download_file=rfc1867.c.diff-4.0.6.gz
> * For PHP 3.0
> http://www.php.net/do_download.php?download_file=mime.c.diff-3.0.gz
>
> If you are using version 4.20-dev, you are not affected by this
> vulnerability. Quoting from
> http://security.e-matters.de/advisories/012002.htm:
>
> "[U]sers running PHP 4.2.0-dev from cvs are not vulnerable to any
> of the described bugs because the fileupload code was completly
> rewritten for the 4.2.0 branch."
>
>Disable fileuploads
>
> If upgrading is not possible or a patch cannot be applied, you can
> avoid these vulnerabilities by disabling fileupload support. Edit the
> PHP configuration file php.ini as follows:
>
> file_uploads = off
>
> Note that this setting only applies to version 4.0.3 and above.
> However, this will prevent you from using fileuploads, which may not
> be acceptable in your environment.
>
>Appendix A. - Vendor Information
>
> This appendix contains information provided by vendors for this
> advisory. When vendors report new information to the CERT/CC, we
> update this section and note the changes in our revision history. If a
> particular vendor is not listed below, we have not received their
> comments.
>
>Apache Software Foundation
>
> Information about this vulnerability is available from
> http://www.php.net
>
>FreeBSD
>
> FreeBSD does not include any version of PHP by default, and so is not
> vulnerable. However, the FreeBSD Ports Collection does contain both
> PHP3 and PHP4 packages. Updates to the PHP packages are in progress
> and corrected packages will be available in the near future.
>
>MandrakeSoft
>
> MandrakeSoft distributes PHP in all distributions and we are currently
> working on patching our versions of PHP for Linux-Mandrake 7.1 and
> 7.2; Mandrake Linux 8.0, 8.0/ppc, 8.1, and 8.1/ia64; Single Network
> Firewall 7.2; Corporate Server 1.0.1.
>
> We anticipate having the updates out by the end of the week.
>
>Microsoft
>
> We do not use PHP in any products.
>
>NCSA
>
> NCSA does not include PHP as an add-in or bundled component in any
> products distributed.
>
>Red Hat
>
> Red Hat was notified of this issue on 27th February 2002. All
> supported versions of Red Hat Linux ship with PHP packages that are
> affected by these vulnerabilities. We will shortly be releasing errata
> packages which contain patched versions that are not vulnerable. The
> errata packages and our advisory will be available on our web site at
> the URL below. At the same time users of the Red Hat Network will be
> able to update their systems to patched versions using the up2date
> tool.
>
> http://www.redhat.com/support/errata/RHSA-2002-035.html
> _________________________________________________________________
>
> The CERT Coordination Center thanks Stefan Esser, upon whose advisory
> this document is largely based.
> _________________________________________________________________
>
> Author: Shawn V. Hernan
> _________________________________________________________________
>
>Appendix B. - References
>
> 1. http://www.kb.cert.org/vuls/id/297363
> 2. http://security.e-matters.de/advisories/012002.html
> 3. http://www.iss.net/security_center/static/8281.php
> ______________________________________________________________________
>
> This document is available from:
> http://www.cert.org/advisories/CA-2002-05.html
> ______________________________________________________________________
>
>CERT/CC Contact Information
>
> Email: cert at cert.org
> Phone: +1 412-268-7090 (24-hour hotline)
> Fax: +1 412-268-6989
> Postal address:
> CERT Coordination Center
> Software Engineering Institute
> Carnegie Mellon University
> Pittsburgh PA 15213-3890
> U.S.A.
>
> CERT/CC personnel answer the hotline 08:00-17:00 EST(GMT-5) /
> EDT(GMT-4) Monday through Friday; they are on call for emergencies
> during other hours, on U.S. holidays, and on weekends.
>
> Using encryption
>
> We strongly urge you to encrypt sensitive information sent by email.
> Our public PGP key is available from
>
> http://www.cert.org/CERT_PGP.key
>
> If you prefer to use DES, please call the CERT hotline for more
> information.
>
> Getting security information
>
> CERT publications and other security information are available from
> our web site
>
> http://www.cert.org/
>
> To subscribe to the CERT mailing list for advisories and bulletins,
> send email to majordomo at cert.org. Please include in the body of your
> message
>
> subscribe cert-advisory
>
> * "CERT" and "CERT Coordination Center" are registered in the U.S.
> Patent and Trademark Office.
> ______________________________________________________________________
>
> NO WARRANTY
> Any material furnished by Carnegie Mellon University and the Software
> Engineering Institute is furnished on an "as is" basis. Carnegie
> Mellon University makes no warranties of any kind, either expressed or
> implied as to any matter including, but not limited to, warranty of
> fitness for a particular purpose or merchantability, exclusivity or
> results obtained from use of the material. Carnegie Mellon University
> does not make any warranty of any kind with respect to freedom from
> patent, trademark, or copyright infringement.
> _________________________________________________________________
>
> Conditions for use, disclaimers, and sponsorship information
>
> Copyright 2002 Carnegie Mellon University.
>
> Revision History
>February 27, 2002: Initial release
>
>-----BEGIN PGP SIGNATURE-----
>Version: PGP 6.5.8
>
>iQCVAwUBPH1T3KCVPMXQI2HJAQGMbwP+NglOFSnTqmCynobjzrF8Onalm5cHNePn
>+fTVP3JVrw5ktpyxtjnqveoMzaai0utVMlIDh4K34MOyipSD37W0ZLRezs0okyN0
>bQt1UTW+pfBQX8CsZ1anCncEmF0/+fBcl3iNtp7jAT99PJveRCsH8GJVpHx/4nT1
>pHvl8ng0VWs=
>=+NsK
>-----END PGP SIGNATURE-----
___________________________________________________
Robin Boulton rboulton at linc.lib.il.us
Automation Coordinator (630) 584 0076 x 258
St. Charles Public Library District Cell: (630) 918 8738
St. Charles, IL 60174 FAX: (630) 584 3448
http://www.st-charles.lib.il.us
___________________________________________________
*********************************************************************
Due to deletion of content types excluded from this list by policy,
this multipart message was reduced to a single part, and from there
to a plain text message.
*********************************************************************
More information about the Web4lib
mailing list