SOL7859 - Multiple PHP vulnerabilities

PHP has been cited with multiple vulnerabilities. For information about these vulnerabilities, refer to the National Vulnerabilities Database.

Information about these advisories is available at the following locations:

• (CVE-2007-1846)
  <http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-1846&gt;
  SQL injection vulnerability in index.php in the MyAds 2.04jp and earlier module for Xoops allows remote attackers to execute arbitrary SQL commands using the cid parameter.

• (CVE-2007-2509)
  <http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-2509&gt;
  CRLF injection vulnerability in the ftp_putcmd function in PHP before 4.4.7, and 5.x before 5.2.2 allows remote attackers to inject arbitrary FTP commands using CRLF sequences in the parameters to earlier FTP commands.

• (CVE-2007-1285)
  <http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-1285&gt;
  A denial of service flaw was found in the way PHP processed a deeply nested array. A remote attacker could cause the PHP interpreter to crash by submitting an input variable with a deeply nested array.

• (CVE-2007-1286)
  <http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-1286&gt;
  A flaw was found in the way PHP’s unserialize() function processed data. If a remote attacker was able to pass arbitrary data to PHP’s unserialize() function, they could possibly execute arbitrary code as the apache user.

• (CVE-2007-1583)
  <http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-1583&gt;
  A flaw was found in the way the mbstring extension set global variables. A script that used the mb_parse_str() function to set global variables could be forced to enable the register_globals configuration option, possibly resulting in global variable injection.

• (CVE-2007-1711)
  <http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-1711&gt;
  A double free flaw was found in PHP’s session_decode() function. If a remote attacker was able to pass arbitrary data to PHP’s session_decode() function, they could possibly execute arbitrary code as the apache user.

• (CVE-2007-1718)
  <http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-1718&gt;
  A flaw was discovered in the way PHP’s mail() function processed header data. If a script sent mail using a subject header containing a string from an untrusted source, a remote attacker could send bulk email to unintended recipients.

• (CVE-2007-1001)
  <http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-1001&gt;
  A heap based buffer overflow flaw was discovered in PHP’s gd extension. A script that could be forced to process WBMP images from an untrusted source could result in arbitrary code execution.

• (CVE-2007-0455)
  <http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-0455&gt;
  A buffer over-read flaw was discovered in PHP’s gd extension. A script that could be forced to write arbitrary string using a JIS font from an untrusted source could cause the PHP interpreter to crash.

F5 Product Development tracked this issue as CR79338 and CR77989 and it was fixed in BIG-IP 9.3.1 and 9.4.1. For information about upgrading, refer to the BIG-IP LTM, GTM, ASM, Link Controller, or WebAccelerator release notes.

Additionally, this issue was fixed in Hotfix-BIG-IP-9.3.0-HF3 issued for BIG-IP 9.3.0. You may download this hotfix or later versions of the cumulative hotfix from the F5 Downloads site.

F5 Product Development tracked this issue as CR86810 and it was fixed in FirePass 6.0.3. For information about upgrading, refer to the FirePass release notes.

Additionally, this issue was fixed in hotfix HF-602-2 issued for FirePass 6.0.2, hotfix HF-601-9 issued for FirePass 6.0.1, and hotfix HF-552-11 issued for FirePass 5.5.2. You may download these hotfixes or later versions of the cumulative hotfix from the F5 Downloads site.

Note: FirePass will silently close invalid connections. This behavior may cause some security scan devices to interpet the silent closure as the FirePass being vulnerable and to report a false positive.

For information about the F5 hotfix policy, refer to SOL4918: Overview of F5 critical issue hotfix policy.

For information about managing F5 product hotfixes, refer to SOL6845: Managing F5 product hotfixes.