-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDKSA-2006:185 http://www.mandriva.com/security/ _______________________________________________________________________ Package : php Date : October 17, 2006 Affected: 2006.0, 2007.0, Corporate 3.0, Corporate 4.0, Multi Network Firewall 2.0 _______________________________________________________________________ Problem Description: PHP 4.x up to 4.4.4 and PHP 5 up to 5.1.6 allows local users to bypass certain Apache HTTP Server httpd.conf options, such as safe_mode and open_basedir, via the ini_restore function, which resets the values to their php.ini (Master Value) defaults. (CVE-2006-4625)
A race condition in the symlink function in PHP 5.1.6 and earlier allows local users to bypass the open_basedir restriction by using a combination of symlink, mkdir, and unlink functions to change the file path after the open_basedir check and before the file is opened by the underlying system, as demonstrated by symlinking a symlink into a subdirectory, to point to a parent directory via .. (dot dot) sequences, and then unlinking the resulting symlink. (CVE-2006-5178) Because the design flaw cannot be solved it is strongly recommended to disable the symlink() function if you are using the open_basedir feature. You can achieve that by adding symlink to the list of disabled functions within your php.ini: disable_functions=...,symlink The updated packages do not alter the system php.ini. Updated packages have been patched to correct the CVE-2006-4625 issue. Users must restart Apache for the changes to take effect. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4625 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5178 _______________________________________________________________________ Updated Packages: Mandriva Linux 2006.0: 7b9ad6634f3b5307025b87ad98561bd4 2006.0/i586/libphp5_common5-5.0.4-9.16.20060mdk.i586.rpm 0d8236ff100de2f5302823d5ba5b2352 2006.0/i586/php-cgi-5.0.4-9.16.20060mdk.i586.rpm 2a571c3bce931c414c23cf60a7adf794 2006.0/i586/php-cli-5.0.4-9.16.20060mdk.i586.rpm 1b5cc543c1274843eaa00e72d9ee0862 2006.0/i586/php-devel-5.0.4-9.16.20060mdk.i586.rpm 7c1c90f460b51eb7675f9fa297e49db6 2006.0/i586/php-fcgi-5.0.4-9.16.20060mdk.i586.rpm 017578a23304ae4f57d24de3d3f15cd8 2006.0/SRPMS/php-5.0.4-9.16.20060mdk.src.rpm Mandriva Linux 2006.0/X86_64: 2a059bc5330467dbeba77ea79b647874 2006.0/x86_64/lib64php5_common5-5.0.4-9.16.20060mdk.x86_64.rpm 3a59479574575a357e841abfbce8b143 2006.0/x86_64/php-cgi-5.0.4-9.16.20060mdk.x86_64.rpm 75e164fa3b7be5cd31d89c14e97abc7c 2006.0/x86_64/php-cli-5.0.4-9.16.20060mdk.x86_64.rpm 247d30753dfd7905dd551acddfe9ec38 2006.0/x86_64/php-devel-5.0.4-9.16.20060mdk.x86_64.rpm 30c793f9c493c8f75d554b9831adcc41 2006.0/x86_64/php-fcgi-5.0.4-9.16.20060mdk.x86_64.rpm 017578a23304ae4f57d24de3d3f15cd8 2006.0/SRPMS/php-5.0.4-9.16.20060mdk.src.rpm Mandriva Linux 2007.0: 6fe8562e783fc7ba1ffe6004747f6ea1 2007.0/i586/libphp5_common5-5.1.6-1.2mdv2007.0.i586.rpm 9535734bceebf3f5866d88df9ce13416 2007.0/i586/php-cgi-5.1.6-1.2mdv2007.0.i586.rpm 9c205cc11ea4bd566528cf484da6a799 2007.0/i586/php-cli-5.1.6-1.2mdv2007.0.i586.rpm ea9d3720bab8912cedb03ba031448f02 2007.0/i586/php-devel-5.1.6-1.2mdv2007.0.i586.rpm dbfdb03f5d8959305a74bee6d01f87bb 2007.0/i586/php-fcgi-5.1.6-1.2mdv2007.0.i586.rpm 7576b12cb3591dbc2ccda6a364ad78a0 2007.0/SRPMS/php-5.1.6-1.2mdv2007.0.src.rpm Mandriva Linux 2007.0/X86_64: 1d5b9358b862e3d5a329d9e8dfdca7d6 2007.0/x86_64/lib64php5_common5-5.1.6-1.2mdv2007.0.x86_64.rpm e761594b551c9416d3c525acd3404ec9 2007.0/x86_64/php-cgi-5.1.6-1.2mdv2007.0.x86_64.rpm e33c203f34d05200eae7e807eb55db06 2007.0/x86_64/php-cli-5.1.6-1.2mdv2007.0.x86_64.rpm 8ff2c627456c5be71a49fe9713d7a04b 2007.0/x86_64/php-devel-5.1.6-1.2mdv2007.0.x86_64.rpm 251c46935c1137cec958766aef5940ee 2007.0/x86_64/php-fcgi-5.1.6-1.2mdv2007.0.x86_64.rpm 7576b12cb3591dbc2ccda6a364ad78a0 2007.0/SRPMS/php-5.1.6-1.2mdv2007.0.src.rpm Corporate 3.0: 94d92ba1402025e29384e46c1e1d8417 corporate/3.0/i586/libphp_common432-4.3.4-4.21.C30mdk.i586.rpm 24b459dc2a595622306ffa6dd81110eb corporate/3.0/i586/php432-devel-4.3.4-4.21.C30mdk.i586.rpm dbcf46a2ea6ec148aef9def41559cb2c corporate/3.0/i586/php-cgi-4.3.4-4.21.C30mdk.i586.rpm c20d060d73d89bab88e20a1d2b7eb317 corporate/3.0/i586/php-cli-4.3.4-4.21.C30mdk.i586.rpm 2f30a3b70a2a71033239ab9f1a225007 corporate/3.0/SRPMS/php-4.3.4-4.21.C30mdk.src.rpm Corporate 3.0/X86_64: 6a8d26121ca42d6412027e782ab3155e corporate/3.0/x86_64/lib64php_common432-4.3.4-4.21.C30mdk.x86_64.rpm f57e2926bd5720c4a701c30eff89c3d9 corporate/3.0/x86_64/php432-devel-4.3.4-4.21.C30mdk.x86_64.rpm 6bc7d2d669a7de8488a916daca0f9537 corporate/3.0/x86_64/php-cgi-4.3.4-4.21.C30mdk.x86_64.rpm 36a84a2b19392ac8fc233f284fefd4b1 corporate/3.0/x86_64/php-cli-4.3.4-4.21.C30mdk.x86_64.rpm 2f30a3b70a2a71033239ab9f1a225007 corporate/3.0/SRPMS/php-4.3.4-4.21.C30mdk.src.rpm Corporate 4.0: 9a16fa6647a207b0b1bb83d3ffa9c0a7 corporate/4.0/i586/libphp4_common4-4.4.4-1.1.20060mlcs4.i586.rpm cf05e55a175a6ef9082f921138e075d8 corporate/4.0/i586/libphp5_common5-5.1.6-1.1.20060mlcs4.i586.rpm e21a56860c5b39ad4d0a973d0b5c04ae corporate/4.0/i586/php4-cgi-4.4.4-1.1.20060mlcs4.i586.rpm 80ace134c6d464d2eae73f412792f824 corporate/4.0/i586/php4-cli-4.4.4-1.1.20060mlcs4.i586.rpm 41eb1b206d4ee9fc4e7a9536fe736e71 corporate/4.0/i586/php4-devel-4.4.4-1.1.20060mlcs4.i586.rpm 59f2320d9b1a149bde3addd9e6cd6f62 corporate/4.0/i586/php-cgi-5.1.6-1.1.20060mlcs4.i586.rpm 20a49834ba864b820956b8758cecbfe4 corporate/4.0/i586/php-cli-5.1.6-1.1.20060mlcs4.i586.rpm a02cc4ffa1999da4ee3479b0af25972b corporate/4.0/i586/php-devel-5.1.6-1.1.20060mlcs4.i586.rpm 4e4d849a1af4e2d74175ee0492585472 corporate/4.0/i586/php-fcgi-5.1.6-1.1.20060mlcs4.i586.rpm 8d0b699e033d7032f7a7395c09db0d8d corporate/4.0/SRPMS/php4-4.4.4-1.1.20060mlcs4.src.rpm ebb91921a4759e8f8c796a76b19903e0 corporate/4.0/SRPMS/php-5.1.6-1.1.20060mlcs4.src.rpm Corporate 4.0/X86_64: 88081e7ca8787e0c3a28bf09b8a3b276 corporate/4.0/x86_64/lib64php4_common4-4.4.4-1.1.20060mlcs4.x86_64.rpm 06b0f4c04cc26c495421ad45dd54fbef corporate/4.0/x86_64/lib64php5_common5-5.1.6-1.1.20060mlcs4.x86_64.rpm a978e89b61aebec8ab614f5fae97610b corporate/4.0/x86_64/php4-cgi-4.4.4-1.1.20060mlcs4.x86_64.rpm f63d42fbfadba50cc664e6e1d45cd75b corporate/4.0/x86_64/php4-cli-4.4.4-1.1.20060mlcs4.x86_64.rpm 8ffc4994ae4916f3f02affe22e34506d corporate/4.0/x86_64/php4-devel-4.4.4-1.1.20060mlcs4.x86_64.rpm 973b5ad29c8824382bdc590938275edb corporate/4.0/x86_64/php-cgi-5.1.6-1.1.20060mlcs4.x86_64.rpm db0a9003ca5f6a0a45e480755a32a6c9 corporate/4.0/x86_64/php-cli-5.1.6-1.1.20060mlcs4.x86_64.rpm 18aa080e3686268e6127857c354cda6a corporate/4.0/x86_64/php-devel-5.1.6-1.1.20060mlcs4.x86_64.rpm f3a6f93b353b9d4bdbf45f0d90b31d3f corporate/4.0/x86_64/php-fcgi-5.1.6-1.1.20060mlcs4.x86_64.rpm 8d0b699e033d7032f7a7395c09db0d8d corporate/4.0/SRPMS/php4-4.4.4-1.1.20060mlcs4.src.rpm ebb91921a4759e8f8c796a76b19903e0 corporate/4.0/SRPMS/php-5.1.6-1.1.20060mlcs4.src.rpm Multi Network Firewall 2.0: 0658393ea4e410043f9870bd7c501c94 mnf/2.0/i586/libphp_common432-4.3.4-4.21.M20mdk.i586.rpm bd00bdb12dd43728047dff4eda4e31bf mnf/2.0/i586/php432-devel-4.3.4-4.21.M20mdk.i586.rpm d7a103f7ec687688b117d1ed1193ef47 mnf/2.0/i586/php-cgi-4.3.4-4.21.M20mdk.i586.rpm 872e6981783ce2afe256210322997b5c mnf/2.0/i586/php-cli-4.3.4-4.21.M20mdk.i586.rpm 30afbb282708f88fb06eb0b1fd2ae371 mnf/2.0/SRPMS/php-4.3.4-4.21.M20mdk.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2.2 (GNU/Linux) iD8DBQFFNUjRmqjQ0CJFipgRApJUAJ9tTYAQ3Wj018j10ZTPcIUPDwtVugCfWFmO +bWFp+FLdKuvZ40LZXLJLFk= =ZsnD -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
