Ubuntu 1437-1: PHP vulnerability

    Date 04 May 2012
    Posted By LinuxSecurity Advisories
    Standalone PHP CGI scripts could be made to execute arbitrary code withthe privilege of the web server.
    Ubuntu Security Notice USN-1437-1
    May 04, 2012
    php5 vulnerability
    A security issue affects these releases of Ubuntu and its derivatives:
    - Ubuntu 12.04 LTS
    - Ubuntu 11.10
    - Ubuntu 11.04
    - Ubuntu 10.04 LTS
    - Ubuntu 8.04 LTS
    Standalone PHP CGI scripts could be made to execute arbitrary code with
    the privilege of the web server.
    Software Description:
    - php5: HTML-embedded scripting language interpreter
    It was discovered that PHP, when used as a stand alone CGI processor
    for the Apache Web Server, did not properly parse and filter query
    strings. This could allow a remote attacker to execute arbitrary code
    running with the privilege of the web server. Configurations using
    mod_php5 and FastCGI were not vulnerable.
    This update addresses the issue when the PHP CGI interpreter
    is configured using mod_cgi and mod_actions as described
    in /usr/share/doc/php5-cgi/README.Debian.gz; however,
    if an alternate configuration is used to enable PHP CGI
    processing, it should be reviewed to ensure that command line
    arguments cannot be passed to the PHP interpreter. Please see
    for more details and potential mitigation approaches.
    Update instructions:
    The problem can be corrected by updating your system to the following
    package versions:
    Ubuntu 12.04 LTS:
      php5-cgi                        5.3.10-1ubuntu3.1
    Ubuntu 11.10:
      php5-cgi                        5.3.6-13ubuntu3.7
    Ubuntu 11.04:
      php5-cgi                        5.3.5-1ubuntu7.8
    Ubuntu 10.04 LTS:
      php5-cgi                        5.3.2-1ubuntu4.15
    Ubuntu 8.04 LTS:
      php5-cgi                        5.2.4-2ubuntu5.24
    In general, a standard system update will make all the necessary changes.
      CVE-2012-1823, CVE-2012-2311
    Package Information:

    LinuxSecurity Poll

    If you are using full-disk encryption: are you concerned about the resulting performance hit?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 2 answer(s).
    [{"id":"120","title":"Yes","votes":"14","type":"x","order":"1","pct":58.33,"resources":[]},{"id":"121","title":"No ","votes":"10","type":"x","order":"2","pct":41.67,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
    bottom 200

    Please enable / Bitte aktiviere JavaScript!
    Veuillez activer / Por favor activa el Javascript![ ? ]

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.