Ubuntu 1437-1: PHP vulnerability

    Date04 May 2012
    CategoryUbuntu
    47
    Posted ByLinuxSecurity Advisories
    Standalone PHP CGI scripts could be made to execute arbitrary code withthe privilege of the web server.
    ==========================================================================
    Ubuntu Security Notice USN-1437-1
    May 04, 2012
    
    php5 vulnerability
    ==========================================================================
    
    A security issue affects these releases of Ubuntu and its derivatives:
    
    - Ubuntu 12.04 LTS
    - Ubuntu 11.10
    - Ubuntu 11.04
    - Ubuntu 10.04 LTS
    - Ubuntu 8.04 LTS
    
    Summary:
    
    Standalone PHP CGI scripts could be made to execute arbitrary code with
    the privilege of the web server.
    
    Software Description:
    - php5: HTML-embedded scripting language interpreter
    
    Details:
    
    It was discovered that PHP, when used as a stand alone CGI processor
    for the Apache Web Server, did not properly parse and filter query
    strings. This could allow a remote attacker to execute arbitrary code
    running with the privilege of the web server. Configurations using
    mod_php5 and FastCGI were not vulnerable.
    
    This update addresses the issue when the PHP CGI interpreter
    is configured using mod_cgi and mod_actions as described
    in /usr/share/doc/php5-cgi/README.Debian.gz; however,
    if an alternate configuration is used to enable PHP CGI
    processing, it should be reviewed to ensure that command line
    arguments cannot be passed to the PHP interpreter. Please see
    http://people.canonical.com/~ubuntu-security/cve/2012/CVE-2012-2311.html
    for more details and potential mitigation approaches.
    
    Update instructions:
    
    The problem can be corrected by updating your system to the following
    package versions:
    
    Ubuntu 12.04 LTS:
      php5-cgi                        5.3.10-1ubuntu3.1
    
    Ubuntu 11.10:
      php5-cgi                        5.3.6-13ubuntu3.7
    
    Ubuntu 11.04:
      php5-cgi                        5.3.5-1ubuntu7.8
    
    Ubuntu 10.04 LTS:
      php5-cgi                        5.3.2-1ubuntu4.15
    
    Ubuntu 8.04 LTS:
      php5-cgi                        5.2.4-2ubuntu5.24
    
    In general, a standard system update will make all the necessary changes.
    
    References:
      http://www.ubuntu.com/usn/usn-1437-1
      CVE-2012-1823, CVE-2012-2311
    
    Package Information:
      https://launchpad.net/ubuntu/+source/php5/5.3.10-1ubuntu3.1
      https://launchpad.net/ubuntu/+source/php5/5.3.6-13ubuntu3.7
      https://launchpad.net/ubuntu/+source/php5/5.3.5-1ubuntu7.8
      https://launchpad.net/ubuntu/+source/php5/5.3.2-1ubuntu4.15
      https://launchpad.net/ubuntu/+source/php5/5.2.4-2ubuntu5.24
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"25","type":"x","order":"1","pct":54.35,"resources":[]},{"id":"88","title":"Should be more technical","votes":"5","type":"x","order":"2","pct":10.87,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"16","type":"x","order":"3","pct":34.78,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.