-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
AA-2007.0005                  AUSCERT Advisory

                             [Win][UNIX/Linux]
                   PHP 4 and 5 multiple vulnerabilities
                             20 February 2007
- ---------------------------------------------------------------------------

        AusCERT Advisory Summary
        ------------------------

Product:              PHP 5.2.0 and prior
                      PHP 4.4.4 and prior
Operating System:     UNIX variants (UNIX, Linux, OSX)
                      Windows
Impact:               Execute Arbitrary Code/Commands
                      Read-only Data Access
                      Reduced Security
Access:               Remote/Unauthenticated
CVE Names:            CVE-2006-6383 CVE-2007-0905 CVE-2007-0906
                      CVE-2007-0907 CVE-2007-0908 CVE-2007-0909
                      CVE-2007-0910 CVE-2007-0911
Member content until: Monday, March 12 2007

Original Bulletin:    http://www.php.net/ChangeLog-5.php

Revision History:  February 20 2007: Added additional CVE names
                   February 12 2007: Initial Release


OVERVIEW:

	PHP 5.2.1 has been released fixing several security issues.
	These same vulnerabilities also exist in PHP 4.4.4 and prior.

	1. Buffer overflow vulnerabilities in the following components:
	       - stream filters
	       - the session, zip, imap and sqlite extensions
	       - str_replace(), mail(), ibase_add_user(), 
	         ibase_delete_user() and ibase_modify_user() functions

	2. Format string vulnerabilities in odbc_result_all() and *print() 
	   functions. The *print() functions are vulnerable only on 64-bit 
	   platforms.

	3. safe_mode and open_basedir restrictions can be bypassed via the
	   session extension.

	4. An information disclosure vulnerability exists in the wddx 
	   extension.

	5. Several other potential security issues including resource 
	   allocation and destruction errors, and incorrect input processing 
	   in the filter extension.


IMPACT:

	The impact of each vulnerability has not yet been disclosed. 
	
	Several of these issues may potentially allow an attacker to
	execute arbitrary code and compromise the web server remotely.


MITIGATION:

	Upgrade to PHP version 5.2.1. [1] 

	The PHP Group state that PHP 4.4.5 will also be released fixing 
	these vulnerabilities, but this is not available as yet.


REFERENCES:

	[1] PHP 5.2.1 Release Announcement
	    http://www.php.net/releases/5_2_1.php


AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBRdpB/ih9+71yA2DNAQK6GAP/fhVNwtsVM7xsQV4kyFzUBRg+cHO0PB6a
fyNRZPf0oA3EqSL/rs1UFNDZkmhAcU24RJrolqHSFvmseuUs7Zubh9mR+2YzhxHo
Ls1Wgw/MBg6lEur7oZ2qTQWHbp+sGhfU6MTzKvhL2mpw33gIeOVKSGKmaqS3bXy7
ySLs3VeSj8c=
=1vn7
-----END PGP SIGNATURE-----