| Descripción: | Description:
The remote host is missing an update to php
announced via advisory MDKSA-2005:213.
A number of vulnerabilities were discovered in PHP:
An issue with fopen_wrappers.c would not properly restrict access to
other directories when the open_basedir directive included a trailing
slash (CVE-2005-3054)
this issue does not affect Corporate Server 2.1.
An issue with the apache2handler SAPI in mod_php could allow an
attacker to cause a Denial of Service via the session.save_path option
in an .htaccess file or VirtualHost stanza (CVE-2005-3319)
this issue
does not affect Corporate Server 2.1.
A Denial of Service vulnerability was discovered in the way that PHP
processes EXIF image data which could allow an attacker to cause PHP
to crash by supplying carefully crafted EXIF image data
(CVE-2005-3353).
A cross-site scripting vulnerability was discovered in the phpinfo()
function which could allow for the injection of javascript or HTML
content onto a page displaying phpinfo() output, or to steal data such
as cookies (CVE-2005-3388).
A flaw in the parse_str() function could allow for the enabling of
register_globals, even if it was disabled in the PHP configuration
file (CVE-2005-3389).
A vulnerability in the way that PHP registers global variables during
a file upload request could allow a remote attacker to overwrite the
$GLOBALS array which could potentially lead the execution of arbitrary
PHP commands. This vulnerability only affects systems with
register_globals enabled (CVE-2005-3390).
The updated packages have been patched to address this issue. Once the
new packages have been installed, you will need to restart your Apache
server using service httpd restart in order for the new packages to
take effect (service httpd2-naat restart for MNF2).
Affected: 10.1, 10.2, 2006.0, Corporate 2.1, Corporate 3.0,
Multi Network Firewall 2.0
Solution:
To upgrade automatically use MandrakeUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
http://www.securityspace.com/smysecure/catid.html?in=MDKSA-2005:213
http://www.hardened-php.net/advisory_202005.79.html
http://www.hardened-php.net/advisory_192005.78.html
http://www.hardened-php.net/advisory_182005.77.html
Risk factor : High
CVSS Score:
7.5
|
