suPHP Multiple Local Privilege Escalation Vulnerabilities

Bugtraq ID:	28568
Class:	Race Condition Error
CVE:	CVE-2008-1614
Remote:	No
Local:	Yes
Published:	Apr 02 2008 12:00AM
Updated:	Apr 18 2008 12:29AM
Credit:	The vendor reported this issue.
Vulnerable:	suPHP suPHP 0.6.2 suPHP suPHP 0.5.2 suPHP suPHP 0.5.1 suPHP suPHP 0.5 suPHP suPHP 0.3.1 suPHP suPHP 0.3 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0
Not Vulnerable:	suPHP suPHP 0.6.3

suPHP Multiple Local Privilege Escalation Vulnerabilities

suPHP is prone to multiple local privilege-escalation vulnerabilities, due to various race conditions that occur in the affected application.

Successfully exploiting these issues will allow attackers to gain elevated privileges on the affected computer.

suPHP Multiple Local Privilege Escalation Vulnerabilities

An attacker uses readily available commands to exploit these issues.

suPHP Multiple Local Privilege Escalation Vulnerabilities

Solution:
The vendor has released fixes. Please see the references for more information.


suPHP suPHP 0.3

• suPHP suphp-0.6.3.tar.gz
  http://www.suphp.org/download/suphp-0.6.3.tar.gz

suPHP suPHP 0.3.1

• suPHP suphp-0.6.3.tar.gz
  http://www.suphp.org/download/suphp-0.6.3.tar.gz

suPHP suPHP 0.5

• suPHP suphp-0.6.3.tar.gz
  http://www.suphp.org/download/suphp-0.6.3.tar.gz

suPHP suPHP 0.5.1

• suPHP suphp-0.6.3.tar.gz
  http://www.suphp.org/download/suphp-0.6.3.tar.gz

suPHP suPHP 0.5.2

• suPHP suphp-0.6.3.tar.gz
  http://www.suphp.org/download/suphp-0.6.3.tar.gz

suPHP suPHP 0.6.2

• suPHP suphp-0.6.3.tar.gz
  http://www.suphp.org/download/suphp-0.6.3.tar.gz

suPHP Multiple Local Privilege Escalation Vulnerabilities

References:

• suPHP Homepage (suPHP)
  
• SECURITY ISSUE: Immediate update advised (suPHP)