[Snort-users] PHP4 advisory... ACID?

Dragos Ruiu dr at ...381...
Mon Jan 22 06:08:24 EST 2001


url: http://www.linuxsecurity.com/advisories/other_advisory-1060.html

- --------------------------------------------------------------------------
CONECTIVA LINUX SECURITY ANNOUNCEMENT
- --------------------------------------------------------------------------

PACKAGE   : php4
SUMMARY   : Problems with per-directory php directives and with virtual hosts
DATE      : 2001-01-18 13:52:00
ID        : CLA-2001:373
RELEVANT
RELEASES  : 6.0

- -------------------------------------------------------------------------

DESCRIPTION
The php4 module shipped with Conectiva Linux 6.0 has two security
problems that were recently made public by the PHP development team
based on a report by James Moore:

1) It is possible to specify PHP directives on a per-directory basis
under apache. In the vulnerable versions of PHP, a remote attacker
could craft an HTTP request that would cause the next page to be
served with the wrong values for these directives.

2) Even though PHP is installed, it can be deactivated and activated
via a directive like "engine=off" or "engine=on". This directive can
be used on a per-directory basis or even per virtual host. Vulnerable
versions of the php4 module could "leak" the "engine=off" setting to
other virtual hosts on the same machine, effectively disabling PHP
for those hosts and resulting in PHP source code being sent to the
client instead of being executed on the server.


SOLUTION
It is recommended that all php4 module users upgrade their packages.
A workaround for the second problem is to explicitly enable PHP on
all virtual hosts that require it if at least one virtual host has
the "engine=off" directive.

3.0.x versions of the PHP module are not affected by these problems.


DIRECT DOWNLOAD LINKS TO THE UPDATED PACKAGES 
ftp://atualizacoes.conectiva.com.br/6.0/SRPMS/php4-4.0.4pl1-1cl.src.rpm 
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/php4-4.0.4pl1-1cl.i386.rpm 
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/php4-doc-4.0.4pl1-1cl.i386.rpm 
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/php4-imap-4.0.4pl1-1cl.i386.rpm 
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/php4-ldap-4.0.4pl1-1cl.i386.rpm 
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/php4-mysql-4.0.4pl1-1cl.i386.rpm 
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/php4-pgsql-4.0.4pl1-1cl.i386.rpm 
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/mod_php4-4.0.4pl1-1cl.i386.rpm

ADDITIONAL INSTRUCTIONS
Users of Conectiva Linux version 6.0 or higher may use apt to perform
upgrades:
- add the following line to /etc/apt/sources.list if it is not there yet
(you may also use linuxconf to do this):

rpm [cncbr]  ftp://atualizacoes.conectiva.com.br 6.0/conectiva updates

- run:                 apt-get update
- after that, execute: apt-get upgrade

Detailed instructions reagarding the use of apt and upgrade examples
can be found at  http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en


- -------------------------------------------------------------------------
All packages are signed with Conectiva's GPG key. The key and instructions
on how to import it can be found at 
http://distro.conectiva.com.br/seguranca/chave/?idioma=en
Instructions on how to check the signatures of the RPM packages can be
found at  http://distro.conectiva.com.br/seguranca/politica/?idioma=en

- -------------------------------------------------------------------------
All our advisories and generic update instructions can be viewed at 
http://www.conectiva.com.br/suporte/atualizacoes


-- 
Dragos Ruiu <dr at ...50...>   dursec.com ltd. / kyx.net - we're from the future 
gpg/pgp key on file at wwwkeys.pgp.net




More information about the Snort-users mailing list