![[LWN Logo]](/images/lcorner.png)
![[Timeline]](/images/Included.png)
|
|
|
|
Date: Thu, 18 Jan 2001 13:54:36 -0200 To: conectiva-updates@papaleguas.conectiva.com.br, Subject: [CLA-2001:373] Conectiva Linux Security Announcement - php4 From: secure@conectiva.com.br -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- CONECTIVA LINUX SECURITY ANNOUNCEMENT - -------------------------------------------------------------------------- PACKAGE : php4 SUMMARY : Problems with per-directory php directives and with virtual hosts DATE : 2001-01-18 13:52:00 ID : CLA-2001:373 RELEVANT RELEASES : 6.0 - ------------------------------------------------------------------------- DESCRIPTION The php4 module shipped with Conectiva Linux 6.0 has two security problems that were recently made public by the PHP development team based on a report by James Moore: 1) It is possible to specify PHP directives on a per-directory basis under apache. In the vulnerable versions of PHP, a remote attacker could craft an HTTP request that would cause the next page to be served with the wrong values for these directives. 2) Even though PHP is installed, it can be deactivated and activated via a directive like "engine=off" or "engine=on". This directive can be used on a per-directory basis or even per virtual host. Vulnerable versions of the php4 module could "leak" the "engine=off" setting to other virtual hosts on the same machine, effectively disabling PHP for those hosts and resulting in PHP source code being sent to the client instead of being executed on the server. SOLUTION It is recommended that all php4 module users upgrade their packages. A workaround for the second problem is to explicitly enable PHP on all virtual hosts that require it if at least one virtual host has the "engine=off" directive. 3.0.x versions of the PHP module are not affected by these problems. DIRECT DOWNLOAD LINKS TO THE UPDATED PACKAGES ftp://atualizacoes.conectiva.com.br/6.0/SRPMS/php4-4.0.4pl1-1cl.src.rpm ftp://atualizacoes.conectiva.com.br/6.0/RPMS/php4-4.0.4pl1-1cl.i386.rpm ftp://atualizacoes.conectiva.com.br/6.0/RPMS/php4-doc-4.0.4pl1-1cl.i386.rpm ftp://atualizacoes.conectiva.com.br/6.0/RPMS/php4-imap-4.0.4pl1-1cl.i386.rpm ftp://atualizacoes.conectiva.com.br/6.0/RPMS/php4-ldap-4.0.4pl1-1cl.i386.rpm ftp://atualizacoes.conectiva.com.br/6.0/RPMS/php4-mysql-4.0.4pl1-1cl.i386.rpm ftp://atualizacoes.conectiva.com.br/6.0/RPMS/php4-pgsql-4.0.4pl1-1cl.i386.rpm ftp://atualizacoes.conectiva.com.br/6.0/RPMS/mod_php4-4.0.4pl1-1cl.i386.rpm ADDITIONAL INSTRUCTIONS Users of Conectiva Linux version 6.0 or higher may use apt to perform upgrades: - add the following line to /etc/apt/sources.list if it is not there yet (you may also use linuxconf to do this): rpm [cncbr] ftp://atualizacoes.conectiva.com.br 6.0/conectiva updates - run: apt-get update - after that, execute: apt-get upgrade Detailed instructions reagarding the use of apt and upgrade examples can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en - ------------------------------------------------------------------------- All packages are signed with Conectiva's GPG key. The key and instructions on how to import it can be found at http://distro.conectiva.com.br/seguranca/chave/?idioma=en Instructions on how to check the signatures of the RPM packages can be found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en - ------------------------------------------------------------------------- All our advisories and generic update instructions can be viewed at http://www.conectiva.com.br/suporte/atualizacoes - ------------------------------------------------------------------------- subscribe: conectiva-updates-subscribe@papaleguas.conectiva.com.br unsubscribe: conectiva-updates-unsubscribe@papaleguas.conectiva.com.br -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.4 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE6ZxG742jd0JmAcZARAgxOAJ95wYSFITX3V0aER9kQzDYE9uEvfQCg0fCQ iJEr8dJNDkwVVJHp0uZfdMI= =9LEk -----END PGP SIGNATURE-----