Vulnerability Bulletins |
Múltiples vulnerabilidades en PHP |
|
Vulnerability classification |
|
| Property | Value |
| Confidence level | Oficial |
| Impact | Obtener acceso |
| Dificulty | Experto |
| Required attacker level | Acceso remoto sin cuenta a un servicio estandar |
System information |
|
| Property | Value |
| Affected manufacturer | GNU/Linux |
| Affected software | PHP < 5.1.5 |
Description |
|
|
Se han descubierto múltiples vulnerabilidades en PHP versión anterior a 5.1.5. Las vulnerabilidades son descritas a continuación: - CVE-2006-4481: La vulnerabilidad reside en errores en las funciones "file_exists" y "imap_reopen" que no comprueban si se han establecido las restricciones de seguridad "safe_mode" y "open_basedir". Un atacante local podría saltarse estas restricciones. - CVE-2006-4484: La vulnerabilidad reside en un desbordamiento de búfer en la función "LWZReadByte_" en "ext/gd/libgd/gd_gif_in.c" de la extensión GD. Se desconoce el impacto del ataque que se podría realizar mediante una imagen GIF con un "input_code_size" mayor que MAX_LWZ_BITS, lo que causa un desbordamiento al inicializar la tabla matriz. - CVE-2006-4485: La vulnerabilidad reside en un error en la función "stripos". Se desconoce el impacto y el método de ataque pero esta relacionado con una lectura fuera de límites. |
|
Solution |
|
|
Actualización de software Mandriva Corporate Server 3.0 X86 ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/3.0/RPMS/libphp_common432-4.3.4-4.20.C30mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/3.0/RPMS/php432-devel-4.3.4-4.20.C30mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/3.0/RPMS/php-cgi-4.3.4-4.20.C30mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/3.0/RPMS/php-cli-4.3.4-4.20.C30mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/3.0/RPMS/php-gd-4.3.4-1.4.C30mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/3.0/RPMS/php-imap-4.3.4-1.4.C30mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/3.0/SRPMS/php-4.3.4-4.20.C30mdk.src.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/3.0/SRPMS/php-gd-4.3.4-1.4.C30mdk.src.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/3.0/SRPMS/php-imap-4.3.4-1.4.C30mdk.src.rpm X86_64 ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/corporate/3.0/RPMS/lib64php_common432-4.3.4-4.20.C30mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/corporate/3.0/RPMS/php432-devel-4.3.4-4.20.C30mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/corporate/3.0/RPMS/php-cgi-4.3.4-4.20.C30mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/corporate/3.0/RPMS/php-cli-4.3.4-4.20.C30mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/corporate/3.0/RPMS/php-gd-4.3.4-1.4.C30mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/corporate/3.0/RPMS/php-imap-4.3.4-1.4.C30mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/corporate/3.0/SRPMS/php-4.3.4-4.20.C30mdk.src.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/corporate/3.0/SRPMS/php-gd-4.3.4-1.4.C30mdk.src.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/corporate/3.0/SRPMS/php-imap-4.3.4-1.4.C30mdk.src.rpm Multi Network Firewall 2.0 X86 ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/mnf/2.0/RPMS/libphp_common432-4.3.4-4.20.M20mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/mnf/2.0/RPMS/php432-devel-4.3.4-4.20.M20mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/mnf/2.0/RPMS/php-cgi-4.3.4-4.20.M20mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/mnf/2.0/RPMS/php-cli-4.3.4-4.20.M20mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/mnf/2.0/RPMS/php-gd-4.3.4-1.4.M20mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/mnf/2.0/SRPMS/php-4.3.4-4.20.M20mdk.src.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/mnf/2.0/SRPMS/php-gd-4.3.4-1.4.M20mdk.src.rpm Mandriva Linux 2006 X86 ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2006.0/RPMS/libphp5_common5-5.0.4-9.14.20060mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2006.0/RPMS/php-cgi-5.0.4-9.14.20060mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2006.0/RPMS/php-cli-5.0.4-9.14.20060mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2006.0/RPMS/php-devel-5.0.4-9.14.20060mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2006.0/RPMS/php-fcgi-5.0.4-9.14.20060mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2006.0/RPMS/php-imap-5.0.4-2.4.20060mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2006.0/SRPMS/php-5.0.4-9.14.20060mdk.src.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2006.0/SRPMS/php-imap-5.0.4-2.4.20060mdk.src.rpm X86_64 ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/2006.0/RPMS/lib64php5_common5-5.0.4-9.14.20060mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/2006.0/RPMS/php-cgi-5.0.4-9.14.20060mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/2006.0/RPMS/php-cli-5.0.4-9.14.20060mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/2006.0/RPMS/php-devel-5.0.4-9.14.20060mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/2006.0/RPMS/php-fcgi-5.0.4-9.14.20060mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/2006.0/RPMS/php-imap-5.0.4-2.4.20060mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/2006.0/SRPMS/php-5.0.4-9.14.20060mdk.src.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/2006.0/SRPMS/php-imap-5.0.4-2.4.20060mdk.src.rpm Mandriva (MDVSA-2008:038) Mandriva Linux 2007 ftp://ftp.cica.es/pub/Linux/Mandrakelinux/official/updates/2007.0/i586/media/main/updates/gd-utils-2.0.33-5.4mdv2007.0.i586.rpm ftp://ftp.cica.es/pub/Linux/Mandrakelinux/official/updates/2007.0/i586/media/main/updates/libgd2-2.0.33-5.4mdv2007.0.i586.rpm ftp://ftp.cica.es/pub/Linux/Mandrakelinux/official/updates/2007.0/i586/media/main/updates/libgd2-devel-2.0.33-5.4mdv2007.0.i586.rpm ftp://ftp.cica.es/pub/Linux/Mandrakelinux/official/updates/2007.0/i586/media/main/updates/libgd2-static-devel-2.0.33-5.4mdv2007.0.i586.rpm ftp://ftp.cica.es/pub/Linux/Mandrakelinux/official/updates/2007.0/SRPMS/main/updates/gd-2.0.33-5.4mdv2007.0.src.rpm X86_64 ftp://ftp.cica.es/pub/Linux/Mandrakelinux/official/updates/2007.0/x86_64/media/main/updates/gd-utils-2.0.33-5.4mdv2007.0.x86_64.rpm ftp://ftp.cica.es/pub/Linux/Mandrakelinux/official/updates/2007.0/x86_64/media/main/updates/lib64gd2-2.0.33-5.4mdv2007.0.x86_64.rpm ftp://ftp.cica.es/pub/Linux/Mandrakelinux/official/updates/2007.0/x86_64/media/main/updates/lib64gd2-devel-2.0.33-5.4mdv2007.0.x86_64.rpm ftp://ftp.cica.es/pub/Linux/Mandrakelinux/official/updates/2007.0/x86_64/media/main/updates/lib64gd2-static-devel-2.0.33-5.4mdv2007.0.x86_64.rpm ftp://ftp.cica.es/pub/Linux/Mandrakelinux/official/updates/2007.0/SRPMS/main/updates/gd-2.0.33-5.4mdv2007.0.src.rpm Corporate Server 4.0 corporate/4.0/i586/gd-utils-2.0.33-3.5.20060mlcs4.i586.rpm corporate/4.0/i586/libgd2-2.0.33-3.5.20060mlcs4.i586.rpm corporate/4.0/i586/libgd2-devel-2.0.33-3.5.20060mlcs4.i586.rpm corporate/4.0/i586/libgd2-static-devel-2.0.33-3.5.20060mlcs4.i586.rpm corporate/4.0/SRPMS/gd-2.0.33-3.5.20060mlcs4.src.rpm X86_64 corporate/4.0/x86_64/gd-utils-2.0.33-3.5.20060mlcs4.x86_64.rpm corporate/4.0/x86_64/lib64gd2-2.0.33-3.5.20060mlcs4.x86_64.rpm corporate/4.0/x86_64/lib64gd2-devel-2.0.33-3.5.20060mlcs4.x86_64.rpm corporate/4.0/x86_64/lib64gd2-static-devel-2.0.33-3.5.20060mlcs4.x86_64.rpm corporate/4.0/SRPMS/gd-2.0.33-3.5.20060mlcs4.src.rpm Suse Linux Las actualizaciones pueden descargarse mediante YAST o del servidor FTP oficial de Suse Linux. Red Hat (RHSA-2008:0146-2) RHEL Desktop Workstation (v. 5 cliente) Red Hat Desktop (v. 4) Red Hat Enterprise Linux (v. 5 servidor) Red Hat Enterprise Linux AS (v. 4) Red Hat Enterprise Linux Desktop (v. 5 cliente) Red Hat Enterprise Linux ES (v. 4) Red Hat Enterprise Linux WS (v. 4) https://rhn.redhat.com/ |
|
Standar resources |
|
| Property | Value |
| CVE |
CVE-2006-4481 CVE-2006-4484 CVE-2006-4485 |
| BID | |
Other resources |
|
|
PHP 5.1.5 Release Announcement http://www.php.net/release_5_1_5.php Mandriva Security Advisory (MDKSA-2006:162) http://www.mandriva.com/security/advisories?name=MDKSA-2006:162 Mandriva Security Advisory (MDVSA-2008:038) http://www.mandriva.com/en/security/advisories?name=MDVSA-2008:038 SUSE Security Advisory (SUSE-SR:2008:003) http://www.novell.com/linux/security/advisories/2008_3_sr.htm SUSE Security Advisory (SUSE-SR:2008:005) http://www.novell.com/linux/security/advisories/2008_5_sr.html SUSE Security Advisory (SUSE-SR:2008:013) http://www.novell.com/linux/security/advisories/2008_13_sr.html Red Hat Security Advisory (RHSA-2008:0146-2) http://rhn.redhat.com/errata/RHSA-2008-0146.html |
|
Version history |
||
| Version | Comments | Date |
| 1.0 | Aviso emitido | 2006-09-12 |
| 1.1 | Aviso emitido por Mandriva (MDVSA-2008:038) | 2008-02-08 |
| 1.2 | Aviso emitido por Suse (SUSE-SR:2008:003) | 2008-02-11 |
| 1.3 | Aviso emitido por Red Hat (RHSA-2008:0146-2) | 2008-02-29 |
| 1.4 | Aviso emitido por Suse (SUSE-SR:2008:005) | 2008-03-07 |
| 1.5 | Aviso emitido por Suse (SUSE-SR:2008:013) | 2008-06-20 |