Búsqueda de    
Vulnerabilidad   
    Buscar 219043 Descripciones CVE y
99761 Descripciones de Pruebas,
accesos 10,000+ referencias cruzadas.
Pruebas   CVE   Todos  

ID de Prueba:1.3.6.1.4.1.25623.1.0.51552
Categoría:Conectiva Local Security Checks
Título:Conectiva Security Advisory CLA-2002:545
Resumen:NOSUMMARY
Descripción:Description:

The remote host is missing updates announced in
advisory CLA-2002:545.

PHP[1] is a very popular scripting language used by web servers to
offer dynamic content.

This update addresses the following issues:

1) Safe mode bypass vulnerability[3]
Wojciech Purczynski reported[2] a vulnerability in
the mail() function which could be used to bypass PHP's safe mode
setting and execute any program as if this mode was not enabled.
Since PHP 4.0.5, the mail() function has a fifth parameter which is
used to pass additional command line parameters to the sendmail
binary. It is possible to use this parameter to change the behaviour
of sendmail and use it to execute arbitrary programs or scripts.
The updated PHP packages disallow the use of this fifth parameter if
safe mode is in use.
This vulnerability affects Conectiva Linux 7.0 and 8 if safe mode is
in use. Conectiva Linux 6.0 was shipped with an earlier version of
PHP which does not have this parameter.

2) Control characters injection[4]
Wojciech Purczynski also reported that it is possible
to insert ASCII control characters (such as '\n') in the text
supplied as parameter to the mail() function. Depending on how the
PHP script handles user input (wheter it is filtered or not, and
how), this could be used to add other mail headers to the message.
This vulnerability affects PHP4 and PHP3. The fix applied to the
packages listed here change such characters, if found in the
subject or to parameter, to a white space ( ).
In a similar way, other functions such as fopen() also accept control
characters in their parameters. This is now also being filtered, and
such characters are being changed to _ (underscore).

3) Old file upload vulnerability[4][6]
While preparing the updates for the above issues, it has come to our
attention that the PHP3 packages in Conectiva Linux 7.0 were not
updated regarding the file upload vulnerability which was addressed
in the CLSA-2002:468[6] advisory. PHP4 is the default PHP package for
that distribution and PHP3 was shipped in the second CD only for
backwards compatibility. The PHP3 packages for CL 7.0 have now been
fixed.


Solution:
The apt tool can be used to perform RPM package upgrades
by running 'apt-get update' followed by 'apt-get upgrade'

http://www.php.net/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0985
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0986
http://online.securityfocus.com/bid/4183
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000468&idioma=en
http://www.securityspace.com/smysecure/catid.html?in=CLA-2002:545
http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=002002

Risk factor : High

CVSS Score:
7.5

Referencia Cruzada: Common Vulnerability Exposure (CVE) ID: CVE-2002-0985
Bugtraq: 20020823 PHP: Bypass safe_mode and inject ASCII control chars with mail() (Google Search)
http://marc.info/?l=bugtraq&m=103011916928204&w=2
Bugtraq: 20030707 [OpenPKG-SA-2003.032] OpenPKG Security Advisory (php) (Google Search)
http://marc.info/?l=bugtraq&m=105760591228031&w=2
Caldera Security Advisory: CSSA-2003-008.0
ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2003-008.0.txt
Conectiva Linux advisory: CLA-2002:545
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000545
Debian Security Information: DSA-168 (Google Search)
http://www.debian.org/security/2002/dsa-168
http://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:082
http://www.osvdb.org/2111
http://www.redhat.com/support/errata/RHSA-2002-213.html
http://www.redhat.com/support/errata/RHSA-2002-214.html
http://www.redhat.com/support/errata/RHSA-2002-243.html
http://www.redhat.com/support/errata/RHSA-2002-244.html
http://www.redhat.com/support/errata/RHSA-2002-248.html
http://www.redhat.com/support/errata/RHSA-2003-159.html
SuSE Security Announcement: SuSE-SA:2002:036 (Google Search)
http://www.novell.com/linux/security/advisories/2002_036_modphp4.html
XForce ISS Database: php-mail-safemode-bypass(9966)
https://exchange.xforce.ibmcloud.com/vulnerabilities/9966
Common Vulnerability Exposure (CVE) ID: CVE-2002-0986
BugTraq ID: 5562
http://www.securityfocus.com/bid/5562
CERT/CC vulnerability note: VU#410609
http://www.kb.cert.org/vuls/id/410609
http://www.osvdb.org/2160
XForce ISS Database: php-mail-ascii-injection(9959)
https://exchange.xforce.ibmcloud.com/vulnerabilities/9959
CopyrightCopyright (c) 2005 E-Soft Inc. http://www.securityspace.com

Esta es sólo una de 99761 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa.

Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.




© 1998-2024 E-Soft Inc. Todos los derechos reservados.