[SECURITY] [DSA-2089-1] New php5 packages fix several vulnerabilities

2010-08-0605:42:32

lists.debian.org

Debian Security Advisory DSA-2089-1 [email protected]
http://www.debian.org/security/ Raphael Geissert
August 6, 2010 http://www.debian.org/security/faq

Package : php5
Vulnerability : several
Problem type : remote
Debian-specific: no
CVE Id(s) : CVE-2010-1917 CVE-2010-2225

Several remote vulnerabilities have been discovered in PHP 5, an hypertext
preprocessor. The Common Vulnerabilities and Exposures project
identifies the following problems:

CVE-2010-1917

The fnmatch function can be abused to conduct denial of service

attacks (by crashing the interpreter) by the means of a stack overflow.

CVE-2010-2225

The SplObjectStorage unserializer allows attackers to execute

arbitrary code via serialized data by the means of a use-after-free
vulnerability.

MOPS-60

The default sessions serializer does not correctly handle a special

marker, which allows an attacker to inject arbitrary variables into the
session and possibly exploit vulnerabilities in the unserializer.

For the vulnerability described by CVE-2010-1128 (predictable entropy

for the Linear Congruential Generator used to generate session ids,) we
do not consider upstream's solution to be sufficient. It is recommended
to uncomment the 'session.entropy_file' and 'session.entropy_length'
settings in the php.ini files.
Further improvements can be achieved by setting 'session.hash_function'
to 1 (one) and incrementing the value of 'session.entropy_length.'

For the stable distribution (lenny), these problems have been fixed in
version 5.2.6.dfsg.1-1+lenny9.

For the testing distribution (squeeze) and the unstable distribution (sid),
these problems will be fixed soon.

We recommend that you upgrade your php5 packages.

Upgrade instructions

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
will update the internal database
apt-get upgrade
will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 5.0 (stable) alias lenny

Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

http://security.debian.org/pool/updates/main/p/php5/php5_5.2.6.dfsg.1.orig.tar.gz
Size/MD5 checksum: 12173741 b80fcee38363f031229368ceff8ced58
http://security.debian.org/pool/updates/main/p/php5/php5_5.2.6.dfsg.1-1+lenny9.dsc
Size/MD5 checksum: 2529 8ccce2ae78389fdf093fc638b9d61152
http://security.debian.org/pool/updates/main/p/php5/php5_5.2.6.dfsg.1-1+lenny9.diff.gz
Size/MD5 checksum: 177397 32868c2bc5907ebeae509a5ae9e27fca

Architecture independent packages:

http://security.debian.org/pool/updates/main/p/php5/php-pear_5.2.6.dfsg.1-1+lenny9_all.deb
Size/MD5 checksum: 334570 a919de2518302133307c52d8e59841e9
http://security.debian.org/pool/updates/main/p/php5/php5_5.2.6.dfsg.1-1+lenny9_all.deb
Size/MD5 checksum: 1082 8eaf906c353774e361210ccce0d3999e

alpha architecture (DEC Alpha)

amd64 architecture (AMD x86_64 (AMD64))

arm architecture (ARM)

armel architecture (ARM EABI)

hppa architecture (HP PA RISC)

i386 architecture (Intel ia32)

ia64 architecture (Intel ia64)

mips architecture (MIPS (Big Endian))

mipsel architecture (MIPS (Little Endian))

powerpc architecture (PowerPC)

s390 architecture (IBM S/390)

sparc architecture (Sun SPARC/UltraSPARC)

These files will probably be moved into the stable distribution on
its next update.

For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: [email protected]
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>

OSVersionArchitecturePackageVersionFilename
Debian5powerpcphp5-mhash< 5.2.6.dfsg.1-1+lenny9php5-mhash_5.2.6.dfsg.1-1+lenny9_powerpc.deb
Debian5i386php5-tidy< 5.2.6.dfsg.1-1+lenny9php5-tidy_5.2.6.dfsg.1-1+lenny9_i386.deb
Debian5armelphp5-curl< 5.2.6.dfsg.1-1+lenny9php5-curl_5.2.6.dfsg.1-1+lenny9_armel.deb
Debian5ia64php5-common< 5.2.6.dfsg.1-1+lenny9php5-common_5.2.6.dfsg.1-1+lenny9_ia64.deb
Debian5armelphp5-dbg< 5.2.6.dfsg.1-1+lenny9php5-dbg_5.2.6.dfsg.1-1+lenny9_armel.deb
Debian5hppalibapache2-mod-php5< 5.2.6.dfsg.1-1+lenny9libapache2-mod-php5_5.2.6.dfsg.1-1+lenny9_hppa.deb
Debian5mipselphp5-odbc< 5.2.6.dfsg.1-1+lenny9php5-odbc_5.2.6.dfsg.1-1+lenny9_mipsel.deb
Debian5amd64php5-snmp< 5.2.6.dfsg.1-1+lenny9php5-snmp_5.2.6.dfsg.1-1+lenny9_amd64.deb
Debian5s390php5-xmlrpc< 5.2.6.dfsg.1-1+lenny9php5-xmlrpc_5.2.6.dfsg.1-1+lenny9_s390.deb
Debian5amd64php5-sybase< 5.2.6.dfsg.1-1+lenny9php5-sybase_5.2.6.dfsg.1-1+lenny9_amd64.deb

OS	Version	Architecture	Package	Version	Filename
Debian	5	powerpc	php5-mhash	< 5.2.6.dfsg.1-1+lenny9	php5-mhash_5.2.6.dfsg.1-1+lenny9_powerpc.deb
Debian	5	i386	php5-tidy	< 5.2.6.dfsg.1-1+lenny9	php5-tidy_5.2.6.dfsg.1-1+lenny9_i386.deb
Debian	5	armel	php5-curl	< 5.2.6.dfsg.1-1+lenny9	php5-curl_5.2.6.dfsg.1-1+lenny9_armel.deb
Debian	5	ia64	php5-common	< 5.2.6.dfsg.1-1+lenny9	php5-common_5.2.6.dfsg.1-1+lenny9_ia64.deb
Debian	5	armel	php5-dbg	< 5.2.6.dfsg.1-1+lenny9	php5-dbg_5.2.6.dfsg.1-1+lenny9_armel.deb
Debian	5	hppa	libapache2-mod-php5	< 5.2.6.dfsg.1-1+lenny9	libapache2-mod-php5_5.2.6.dfsg.1-1+lenny9_hppa.deb
Debian	5	mipsel	php5-odbc	< 5.2.6.dfsg.1-1+lenny9	php5-odbc_5.2.6.dfsg.1-1+lenny9_mipsel.deb
Debian	5	amd64	php5-snmp	< 5.2.6.dfsg.1-1+lenny9	php5-snmp_5.2.6.dfsg.1-1+lenny9_amd64.deb
Debian	5	s390	php5-xmlrpc	< 5.2.6.dfsg.1-1+lenny9	php5-xmlrpc_5.2.6.dfsg.1-1+lenny9_s390.deb
Debian	5	amd64	php5-sybase	< 5.2.6.dfsg.1-1+lenny9	php5-sybase_5.2.6.dfsg.1-1+lenny9_amd64.deb