PHP Multiple Remote Vulnerabilities
BID:11981
Info
PHP Multiple Remote Vulnerabilities
| Bugtraq ID: | 11981 |
| Class: | Input Validation Error |
| CVE: |
CVE-2004-1020 |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 16 2004 12:00AM |
| Updated: | Jul 12 2009 09:26AM |
| Credit: | Discovery is credited to Daniel Fabian <[email protected]>. |
| Vulnerable: |
PHP PHP 5.0.2 PHP PHP 5.0.1 PHP PHP 5.0 candidate 3 PHP PHP 5.0 candidate 2 PHP PHP 5.0 candidate 1 PHP PHP 5.0 .0 PHP PHP 4.3.9 PHP PHP 4.3.8 PHP PHP 4.3.7 PHP PHP 4.3.6 HP System Management Homepage 2.0.2 HP System Management Homepage 2.0.1 HP System Management Homepage 2.0 |
| Not Vulnerable: |
PHP PHP 5.0.3 PHP PHP 4.3.10 HP System Management Homepage 2.1 |
Discussion
PHP Multiple Remote Vulnerabilities
PHP4 and PHP5 are reported prone to multiple remotely exploitable vulnerabilities. These issue result from insufficient sanitization of user-supplied data. A remote attacker may carry out directory traversal attacks to disclose arbitrary files and upload files to arbitrary locations.
It is reported that these vulnerabilities may only be exploited on Windows.
PHP4 and PHP5 are reported prone to multiple remotely exploitable vulnerabilities. These issue result from insufficient sanitization of user-supplied data. A remote attacker may carry out directory traversal attacks to disclose arbitrary files and upload files to arbitrary locations.
It is reported that these vulnerabilities may only be exploited on Windows.
Exploit / POC
PHP Multiple Remote Vulnerabilities
An exploit is not required.
The following proof of concept examples are available:
http://www.example.com/phpscript.php?whatever=../../../../boot.ini%00
http://www.example.com/phpscript.php?whatever=..\'file.ext
An exploit is not required.
The following proof of concept examples are available:
http://www.example.com/phpscript.php?whatever=../../../../boot.ini%00
http://www.example.com/phpscript.php?whatever=..\'file.ext
Solution / Fix
PHP Multiple Remote Vulnerabilities
Solution:
Conectiva has released advisory CLA-2005:915 along with fixes dealing with these and other issues. Please see the referenced advisory for more information.
Mandrake has released advisory MDKSA-2004:151 to address this issue. Please see the attached advisory for details on obtaining and applying fixes.
HP has released advisory HPSBMA01212 to address various issue affecting System Management Homepage. Please see the referenced advisory for more information.
HP has released revision 1 of advisory HPSBMA01212 to address various issue affecting System Management Homepage. Please see the referenced advisory for more information.
Revised HP advisory HPSBMA01212 (SSRT5998 Rev.2 HP System Management Homepage(v2.0.x) Denial of Service (DoS) and XSS) including updated resolutions is available. Please see the referenced advisory for more information.
The vendor has released updated packages to address these issues:
PHP PHP 4.3.6
PHP PHP 4.3.7
PHP PHP 4.3.8
PHP PHP 4.3.9
PHP PHP 5.0 .0
PHP PHP 5.0 candidate 2
PHP PHP 5.0 candidate 3
PHP PHP 5.0 candidate 1
PHP PHP 5.0.1
PHP PHP 5.0.2
Solution:
Conectiva has released advisory CLA-2005:915 along with fixes dealing with these and other issues. Please see the referenced advisory for more information.
Mandrake has released advisory MDKSA-2004:151 to address this issue. Please see the attached advisory for details on obtaining and applying fixes.
HP has released advisory HPSBMA01212 to address various issue affecting System Management Homepage. Please see the referenced advisory for more information.
HP has released revision 1 of advisory HPSBMA01212 to address various issue affecting System Management Homepage. Please see the referenced advisory for more information.
Revised HP advisory HPSBMA01212 (SSRT5998 Rev.2 HP System Management Homepage(v2.0.x) Denial of Service (DoS) and XSS) including updated resolutions is available. Please see the referenced advisory for more information.
The vendor has released updated packages to address these issues:
PHP PHP 4.3.6
-
PHP PHP 4.3.10
http://www.php.net/downloads.php
PHP PHP 4.3.7
-
PHP PHP 4.3.10
http://www.php.net/downloads.php
PHP PHP 4.3.8
-
Mandrake lib64php_common432-4.3.8-3.2.101mdk.x86_64.rpm
Mandrake Linux 10.1/X86_64
http://www.mandrakesecure.net/en/ftp.php -
Mandrake libphp_common432-4.3.8-3.2.101mdk.i586.rpm
Mandrake Linux 10.1
http://www.mandrakesecure.net/en/ftp.php -
Mandrake php-cgi-4.3.8-3.2.101mdk.i586.rpm
Mandrake Linux 10.1
http://www.mandrakesecure.net/en/ftp.php -
Mandrake php-cgi-4.3.8-3.2.101mdk.x86_64.rpm
Mandrake Linux 10.1/X86_64
http://www.mandrakesecure.net/en/ftp.php -
Mandrake php-cli-4.3.8-3.2.101mdk.i586.rpm
Mandrake Linux 10.1
http://www.mandrakesecure.net/en/ftp.php -
Mandrake php-cli-4.3.8-3.2.101mdk.x86_64.rpm
Mandrake Linux 10.1/X86_64
http://www.mandrakesecure.net/en/ftp.php -
Mandrake php432-devel-4.3.8-3.2.101mdk.i586.rpm
Mandrake Linux 10.1
http://www.mandrakesecure.net/en/ftp.php -
Mandrake php432-devel-4.3.8-3.2.101mdk.x86_64.rpm
Mandrake Linux 10.1/X86_64
http://www.mandrakesecure.net/en/ftp.php -
PHP PHP 4.3.10
http://www.php.net/downloads.php
PHP PHP 4.3.9
-
PHP PHP 4.3.10
http://www.php.net/downloads.php
PHP PHP 5.0 .0
-
PHP PHP 5.0.3
http://www.php.net/downloads.php
PHP PHP 5.0 candidate 2
-
PHP PHP 5.0.3
http://www.php.net/downloads.php
PHP PHP 5.0 candidate 3
-
PHP PHP 5.0.3
http://www.php.net/downloads.php
PHP PHP 5.0 candidate 1
-
PHP PHP 5.0.3
http://www.php.net/downloads.php
PHP PHP 5.0.1
-
PHP PHP 5.0.3
http://www.php.net/downloads.php
PHP PHP 5.0.2
-
PHP PHP 5.0.3
http://www.php.net/downloads.php
References
PHP Multiple Remote Vulnerabilities
References:
References:
- PHP Input Validation Vulnerabilities ("Daniel Fabian"