Gentoo Linux PHP Security Advisory

newsguy 0 541 Views

Gentoo has issued a security advisory with a high impact rating affecting users of PHP <5.2.2.

Several vulnerabilities have been found in PHP, not least a huge number discovered by Stefan Esser during the infamous Month Of PHP Bugs (MOPB) including integer overflows in wbmp.c from the GD library and in the substr_compare() PHP 5 function.

There have also been reports of a buffer overflow in the make_http_soap_request() and in the user_filter_factory_create() functions as well as a buffer overflow in the bundled XMLRPC library. If that weren’t enough, the session_regenerate_id() and the array_user_key_compare() functions contain a double-free vulnerability. Oh, and let’s not forget the implementation errors in the Zend engine, in the mb_parse_str(), the unserialize() and the mail() functions and other elements.

The fact that remote attackers therefore have the potential ability to exploit these vulnerabilities in PHP applications which could, of course, lead to arbitrary code execution. And Denial of Service attacks. And scripted content execution within the context of an exploited site. And information leaks due to the bypassing of security.

And the workaround is? Err, it is non-existent actually. If you are a PHP 5 user then you really should make sure you are using the latest available version.

Dani AI

Generated

Gentoo published GLSA 200705-19 (May 26, 2007) to warn that dev-lang/php versions older than 5.2.2 (and PHP 4 older than 4.4.7) contain multiple, serious core vulnerabilities — integer overflows, buffer overflows, double‑free bugs and related implementation errors that under certain conditions can lead to remote code execution, denial-of-service or data disclosure. This is a distribution advisory summarising upstream PHP problems, not a Gentoo‑only bug. GLSA 200705-19 (Bugtraq mirror). (seclists.org)

Many of the issues were disclosed during the Month Of PHP Bugs and fixed upstream in the PHP 5.2.2 release; the 5.2.2 announcement lists the specific fixes (wbmp/GD integer overflow, substr_compare, make_http_soap_request, user_filter_factory_create, bundled libxmlrpc, session_regenerate_id, array_user_key_compare, mb_parse_str, unserialize, mail, etc.). For historical context and the authoritative fix list see the PHP 5.2.2 release notes. PHP 5.2.2 release notes. (php.net)

Operational remediation (Gentoo): follow the GLSA resolution — sync the tree and upgrade PHP to the fixed version, then rebuild any extensions/modules and restart the web server/PHP process. Example GLSA commands (as published): 

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/php-5.2.2"

After upgrading, restart Apache/nginx (or the PHP interpreter), rebuild extensions that depend on PHP, and run a quick functional test suite for the sites. If an immediate upgrade is impossible, reduce attack surface by disabling unneeded extensions (xmlrpc/soap/GD if not required), ensuring register_globals is off and open_basedir/wrapper access is restricted, and by isolating vulnerable sites behind access controls. (seclists.org)

Tie‑backs to the thread: correctly identified Gentoo as the advisory source; ’s question about scope is answered above — this affected PHP itself across distributions; ’s pointer to the Month‑of‑PHP disclosures is relevant background; and ’s quip about switching platforms is a reminder that platform changes are trade‑offs, not instant security fixes. For forensic detail on individual CVEs consult the official CVE/NVD entries (for example CVE‑2007‑1001 and CVE‑2007‑1375). (cve.mitre.org)

Member Avatar for cutepinkbunnies
cutepinkbunnies 4 Junior Poster

They could move over to ASP :)

Member Avatar for John A
John A 1,896 Vampirical Lurker

Just curious, if this is a PHP flaw, then how come it is only affecting Gentoo? Or is Gentoo simply giving the warning on behalf of all PHP 5 users?

Member Avatar for peter_budo
peter_budo 2,532 Code tags enforcer

>They could move over to ASP
microworld of microsoft??? you must by joking. For once it is damn slow, for two it crash often then windows and connection to db is awful. I don't know why all computing colleges actualy teach VB and related products

the Month of PHP Bugs can be found here

Member Avatar for newsguy
newsguy 30 The News Guy

Gentoo is the source of the advisory, sorry for any confusion.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

Edit Preview