-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
                         AUSCERT Security Bulletin

                               ASB-2012.0070
          A number of vulnerabilities have been identified in PHP
                                9 May 2012

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:              PHP
Operating System:     Windows
                      UNIX variants (UNIX, Linux, OSX)
Impact/Access:        Execute Arbitrary Code/Commands -- Remote/Unauthenticated
                      Access Confidential Data        -- Remote/Unauthenticated
Resolution:           Patch/Upgrade
CVE Names:            CVE-2012-2329 CVE-2012-2311 
Member content until: Friday, June  8 2012
Reference:            ASB-2012.0066

OVERVIEW

        A number of vulnerabilities have been identified in PHP prior to
        versions 5.4.3 and 5.3.13.


IMPACT

        The vendor has provided the following details regarding these
        vulnerabilities:
        
        "The releases complete a fix for a vulnerability in CGI-based setups 
        (CVE-2012-2311). Note: mod_php and php-fpm are not vulnerable to this 
        attack." [1]
        
        "PHP 5.4.3 fixes a buffer overflow vulnerability in the 
        apache_request_headers() (CVE-2012-2329). The PHP 5.3 series is not 
        vulnerable to this issue." [1]


MITIGATION

        The vendor recommends upgrading to the latest releases of PHP to
        correct these issues. [1]


REFERENCES

        [1] PHP 5.4.3 and PHP 5.3.13 Released!
            http://www.php.net/archive/2012.php#id2012-05-08-1

AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours 
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBT6nvQe4yVqjM2NGpAQK8eQ/+Kxk5ANcEJq31bkgzVTlXxNAYliNye8is
4WteW+Fsaw93kKWN79a1uVUhkQuP0pkx3rb4DgQgxpdXc1wtaINxgk2Seti5vd1P
jvVFobM51PL1HH2dxj4txuZSGN2ajG8ztKK3p9jHvS1TqlXnG2R75v9OfY4cxv0y
cv5XdBPMGdsWiGul6vMnAY+hY8mpmlW088fGK45i+pCu2iarBFX+GPVTh8l/sIpe
Eh1w8vHkgWAsF2zG3NHGFIlXvgAB9WzI6jc7GRN+g5lb8EuyZ7zm2PvS5ZUnywiJ
nun2oMcm8uC7vIwPKqNZlRbDVpDut47WcJ2q9HB90uXtvJ7FMsECE33jGFGnv562
5EqkK/nYsYWD+Z8jDhJSKWqQGSMqAwJw5ff5SBYquzalZC/SA1g2rTsmhpmg9tTn
4dvwMEAPOY8S0RCJ/niUo/vk5kKV1gY+/Rx86pPTg3t9iAzGrIFv+YVrPp1nw7ct
v5cmfLtaudGZyT+uUh7iesBUBVUznjcXOow1sfCmr3+i+E8bHHwz7V18wOtSd0oE
nvXKx1M116g95IZgkLolXcg8I0ILvFKM3VabwJ8yLIOuiOxAvUEe5wV940GuFsMh
+l8QYQb9mGqrMuiG938nzxiT8ZhxbA7jasms9MXl9FBM0WWn6iNjt2LbsUlx7S3u
APNgonBNAgE=
=nC0Z
-----END PGP SIGNATURE-----