Date: Thu, 18 Jan 2001 13:54:36 -0200
From: secure@CONECTIVA.COM.BR
To: BUGTRAQ@SECURITYFOCUS.COM
Subject: [CLA-2001:373] Conectiva Linux Security Announcement –
php4
CONECTIVA LINUX SECURITY ANNOUNCEMENT
PACKAGE : php4
SUMMARY : Problems with per-directory php directives and with virtual hosts
DATE : 2001-01-18 13:52:00
ID : CLA-2001:373
RELEVANT
RELEASES : 6.0
DESCRIPTION The php4 module shipped with Conectiva Linux 6.0 has
two security problems that were recently made public by the PHP
development team based on a report by James Moore:
1) It is possible to specify PHP directives on a per-directory
basis under apache. In the vulnerable versions of PHP, a remote
attacker could craft an HTTP request that would cause the next page
to be served with the wrong values for these directives.
2) Even though PHP is installed, it can be deactivated and
activated via a directive like “engine=off” or “engine=on”. This
directive can be used on a per-directory basis or even per virtual
host. Vulnerable versions of the php4 module could “leak” the
“engine=off” setting to other virtual hosts on the same machine,
effectively disabling PHP for those hosts and resulting in PHP
source code being sent to the client instead of being executed on
the server.
SOLUTION
It is recommended that all php4 module users upgrade their
packages. A workaround for the second problem is to explicitly
enable PHP on all virtual hosts that require it if at least one
virtual host has the “engine=off” directive.
3.0.x versions of the PHP module are not affected by these
problems.
DIRECT DOWNLOAD LINKS TO THE UPDATED PACKAGES
ftp://atualizacoes.conectiva.com.br/6.0/SRPMS/php4-4.0.4pl1-1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/php4-4.0.4pl1-1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/php4-doc-4.0.4pl1-1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/php4-imap-4.0.4pl1-1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/php4-ldap-4.0.4pl1-1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/php4-mysql-4.0.4pl1-1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/php4-pgsql-4.0.4pl1-1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/mod_php4-4.0.4pl1-1cl.i386.rpm
ADDITIONAL INSTRUCTIONS
Users of Conectiva Linux version 6.0 or higher may use apt to
perform upgrades:
– add the following line to /etc/apt/sources.list if it is not
there yet (you may also use linuxconf to do this):
rpm [cncbr] ftp://atualizacoes.conectiva.com.br
6.0/conectiva updates
- run: apt-get update
- after that, execute: apt-get upgrade
Detailed instructions reagarding the use of apt and upgrade
examples can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en
All packages are signed with Conectiva’s GPG key. The key and
instructions on how to import it can be found at http://distro.conectiva.com.br/seguranca/chave/?idioma=en
Instructions on how to check the signatures of the RPM packages can
be found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en