OpenPKG Security Advisory

Publisher Name:          OpenPKG GmbH
Publisher Home:          http://openpkg.com/

Advisory Id (public):    OpenPKG-SA-2004.034
Advisory Type:           OpenPKG Security Advisory (SA)
Advisory Directory:      http://openpkg.com/go/OpenPKG-SA
Advisory Document:       http://openpkg.com/go/OpenPKG-SA-2004.034
Advisory Published:      2010-02-09 19:11 UTC

Issue Id (internal):     OpenPKG-SI-20040722.02
Issue First Created:     2004-07-22
Issue Last Modified:     2006-11-29
Issue Revision:          08


Subject Name:            PHP
Subject Summary:         Personal HomePage (PHP)
Subject Home:            http://www.php.net/
Subject Versions:        * <= 4.3.7

Vulnerability Id:        CVE-2004-0594, CVE-2004-0595
Vulnerability Scope:     global (not OpenPKG specific)

Attack Feasibility:      run-time
Attack Vector:           remote network
Attack Impact:           identity fraud, arbitrary code execution

Description:
    According to a PHP [0] security advisory [1] from Stefan Esser the
    commonly used "memory_limit" functionality in PHP 4.x up to 4.3.7
    under certain conditions allows remote attackers to execute arbitrary
    code by triggering a "memory_limit" abort during execution of the
    zend_hash_init() function. CVE-2004-0594
    
    According to another security advisory [3] from Stefan Esser the
    strip_tags() function in PHP 4.x up to 4.3.7 does not filter NUL
    characters within tag names, allowing dangerous tags to be processed
    by certain web browsers and facilitate the exploitation of cross-site
    scripting (XSS) vulnerabilities. CVE-2004-0595
    problem.

References:
    [0] http://www.php.net/
    [1] http://security.e-matters.de/advisories/112004.html
    [2] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0594
    [3] http://security.e-matters.de/advisories/122004.html
    [4] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0595
    [5] http://www.openpkg.org/tutorial.html#regular-source
    [6] http://www.openpkg.org/tutorial.html#regular-binary
    [7] ftp://ftp.openpkg.org/release/2.0/UPD/php-4.3.4-2.0.1.src.rpm
    [8] ftp://ftp.openpkg.org/release/2.0/UPD/
    [9] http://www.openpkg.org/security.html#signature


Primary Package Name:    php
Primary Package Home:    http://openpkg.org/go/package/php

Affected Distribution:   Affected Branch:  Affected Package:
OpenPKG Community        2.0-SOLID         apache-1.3.29-2.0.4
OpenPKG Community        2.0-SOLID         php-4.3.4-2.0.0
OpenPKG Community        2.1-SOLID         n/a
OpenPKG Community        2.1-SOLID         n/a
OpenPKG Community        CURRENT           apache-1.3.31-20040713
OpenPKG Community        CURRENT           php-4.3.7-20040611

Corrected Distribution:  Corrected Branch: Corrected Package:
OpenPKG Community        2.0-SOLID         apache-1.3.29-2.0.5
OpenPKG Community        2.0-SOLID         php-4.3.4-2.0.1
OpenPKG Community        2.1-SOLID         n/a
OpenPKG Community        2.1-SOLID         n/a
OpenPKG Community        CURRENT           apache-1.3.31-20040714
OpenPKG Community        CURRENT           php-4.3.8-20040714