Test ID:	1.3.6.1.4.1.25623.1.0.51552
Category:	Conectiva Local Security Checks
Title:	Conectiva Security Advisory CLA-2002:545
Summary:	NOSUMMARY
Description:	Description: The remote host is missing updates announced in advisory CLA-2002:545. PHP[1] is a very popular scripting language used by web servers to offer dynamic content. This update addresses the following issues: 1) Safe mode bypass vulnerability[3] Wojciech Purczynski reported[2] a vulnerability in the mail() function which could be used to bypass PHP's safe mode setting and execute any program as if this mode was not enabled. Since PHP 4.0.5, the mail() function has a fifth parameter which is used to pass additional command line parameters to the sendmail binary. It is possible to use this parameter to change the behaviour of sendmail and use it to execute arbitrary programs or scripts. The updated PHP packages disallow the use of this fifth parameter if safe mode is in use. This vulnerability affects Conectiva Linux 7.0 and 8 if safe mode is in use. Conectiva Linux 6.0 was shipped with an earlier version of PHP which does not have this parameter. 2) Control characters injection[4] Wojciech Purczynski also reported that it is possible to insert ASCII control characters (such as '\n') in the text supplied as parameter to the mail() function. Depending on how the PHP script handles user input (wheter it is filtered or not, and how), this could be used to add other mail headers to the message. This vulnerability affects PHP4 and PHP3. The fix applied to the packages listed here change such characters, if found in the subject or to parameter, to a white space ( ). In a similar way, other functions such as fopen() also accept control characters in their parameters. This is now also being filtered, and such characters are being changed to _ (underscore). 3) Old file upload vulnerability[4][6] While preparing the updates for the above issues, it has come to our attention that the PHP3 packages in Conectiva Linux 7.0 were not updated regarding the file upload vulnerability which was addressed in the CLSA-2002:468[6] advisory. PHP4 is the default PHP package for that distribution and PHP3 was shipped in the second CD only for backwards compatibility. The PHP3 packages for CL 7.0 have now been fixed. Solution: The apt tool can be used to perform RPM package upgrades by running 'apt-get update' followed by 'apt-get upgrade' http://www.php.net/ http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0985 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0986 http://online.securityfocus.com/bid/4183 http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000468&idioma=en http://www.securityspace.com/smysecure/catid.html?in=CLA-2002:545 http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=002002 Risk factor : High CVSS Score: 7.5
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2002-0985 Bugtraq: 20020823 PHP: Bypass safe_mode and inject ASCII control chars with mail() (Google Search) http://marc.info/?l=bugtraq&m=103011916928204&w=2 Bugtraq: 20030707 [OpenPKG-SA-2003.032] OpenPKG Security Advisory (php) (Google Search) http://marc.info/?l=bugtraq&m=105760591228031&w=2 Caldera Security Advisory: CSSA-2003-008.0 ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2003-008.0.txt Conectiva Linux advisory: CLA-2002:545 http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000545 Debian Security Information: DSA-168 (Google Search) http://www.debian.org/security/2002/dsa-168 http://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:082 http://www.osvdb.org/2111 http://www.redhat.com/support/errata/RHSA-2002-213.html http://www.redhat.com/support/errata/RHSA-2002-214.html http://www.redhat.com/support/errata/RHSA-2002-243.html http://www.redhat.com/support/errata/RHSA-2002-244.html http://www.redhat.com/support/errata/RHSA-2002-248.html http://www.redhat.com/support/errata/RHSA-2003-159.html SuSE Security Announcement: SuSE-SA:2002:036 (Google Search) http://www.novell.com/linux/security/advisories/2002_036_modphp4.html XForce ISS Database: php-mail-safemode-bypass(9966) https://exchange.xforce.ibmcloud.com/vulnerabilities/9966 Common Vulnerability Exposure (CVE) ID: CVE-2002-0986 BugTraq ID: 5562 http://www.securityfocus.com/bid/5562 CERT/CC vulnerability note: VU#410609 http://www.kb.cert.org/vuls/id/410609 http://www.osvdb.org/2160 XForce ISS Database: php-mail-ascii-injection(9959) https://exchange.xforce.ibmcloud.com/vulnerabilities/9959
Copyright	Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.