php-5.3.3-14.AXS4
エラータID: AXSA:2012-762:04
リリース日:
2012/08/23 Thursday - 13:42
題名:
php-5.3.3-14.AXS4
影響のあるチャネル:
Asianux Server 4 for x86_64
Asianux Server 4 for x86
Severity:
High
Description:
以下項目について対処しました。
[Security Fix]
- PHP の phar エクステンションの stream.c にはフォーマット文字列の脆弱性が存在し，phar_stream_flush 関数で適切に処理されない巧妙に細工した phar:// URI によって，攻撃者が機密情報 (メモリ内容) を取得する脆弱性があります。
注: この脆弱性は CVE-2010-2094 の不完全な修正によるものです。 (CVE-2010-2950)
- PHP は zend_strndup 関数の返り値をいつもチェックしておらず，巧妙に細工されたアプリケーションの入力によって，リモートの攻撃者がサービス拒否 (ヌルポインタ逆参照とアプリケーションのクラッシュ)を引き起こす脆弱性があります。(CVE-2011-4153)
- PHP には不適切な libxslt のセキュリティの設定があり，巧妙に細工されたXSLT スタイルシートによって，リモートの攻撃者が任意のファイルを作成する脆弱性があります。(CVE-2012-0057)
- PHP の tidy_diagnose 関数には，アプリケーションへの入力によって，リモートの攻撃者がサービス拒否 (ヌルポインタ逆参照とアプリケーションのクラッシュ) を引き起こす脆弱性があります。
この脆弱性は CVE-2011-4153 とは異なる脆弱性となります。
(CVE-2012-0781)
- PHP のタイムゾーン機能にはメモリリークが存在し，多くの strtotime ファンクションコールをきっかけとして，リモートの攻撃者がサービス拒否 (メモリ消費) を引き起こす脆弱性があります。(CVE-2012-0789)
- PHP の rfc1867.c のファイルアップロード実装は，名前の値に含まれる不正な ”[” 文字を適切に処理しておらず，複数のファイルのアップロードの際に，リモートの攻撃者がサービス拒否 (不正な $_FILES インデックス) を引き起こしやすくしたり，ディレクトリトラバーサル攻撃を行いやすくする脆弱性があります。(CVE-2012-1172)
- PHP の sapi/cgi/cgi_main.c は CGI スクリプトとして設定されている場合，"=" 文字が欠けているクエリ文字列を適切に処理しておらず，クエリ文字列にコマンドラインオプションを置くことによって，リモートの攻撃者がサービス拒否 (リソースの消費) を引き起こす脆弱性があります。
注: この脆弱性は CVE-2012-1823 の不完全な修正による脆弱性です。(CVE-2012-2336)
- PHP, PostgreSQL, その他の製品で使用されている crypt_des 関数にはパスワードが 0x80 キャラクタを含んでいる場合，完全なクリアテキストのパスワードを処理せずに，意図したパスワードの最初の部分文字列で認証を試みることによって，攻撃者がアクセスしやすくなる脆弱性があります。(CVE-2012-2143)
- PHP の phar エクステンションの phar_parse_tarfile 関数には整数オーバーフローが存在し，巧妙に細工された tar ファイルによって，リモートの攻撃者がサービス拒否 (アプリケーションのクラッシュ) あるいは任意のコードを実行する可能性のある脆弱性があります。(CVE-2012-2386)
[Enhancement]
- php-bcmath パッケージを追加しました。
一部CVEの翻訳文はJVNからの引用になります。
http://jvndb.jvn.jp
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2010-2950
Format string vulnerability in stream.c in the phar extension in PHP 5.3.x through 5.3.3 allows context-dependent attackers to obtain sensitive information (memory contents) and possibly execute arbitrary code via a crafted phar:// URI that is not properly handled by the phar_stream_flush function, leading to errors in the php_stream_wrapper_log_error function. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-2094.
Format string vulnerability in stream.c in the phar extension in PHP 5.3.x through 5.3.3 allows context-dependent attackers to obtain sensitive information (memory contents) and possibly execute arbitrary code via a crafted phar:// URI that is not properly handled by the phar_stream_flush function, leading to errors in the php_stream_wrapper_log_error function. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-2094.
CVE-2011-4153
PHP 5.3.8 does not always check the return value of the zend_strndup function, which might allow remote attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted input to an application that performs strndup operations on untrusted string data, as demonstrated by the define function in zend_builtin_functions.c, and unspecified functions in ext/soap/php_sdl.c, ext/standard/syslog.c, ext/standard/browscap.c, ext/oci8/oci8.c, ext/com_dotnet/com_typeinfo.c, and main/php_open_temporary_file.c.
PHP 5.3.8 does not always check the return value of the zend_strndup function, which might allow remote attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted input to an application that performs strndup operations on untrusted string data, as demonstrated by the define function in zend_builtin_functions.c, and unspecified functions in ext/soap/php_sdl.c, ext/standard/syslog.c, ext/standard/browscap.c, ext/oci8/oci8.c, ext/com_dotnet/com_typeinfo.c, and main/php_open_temporary_file.c.
CVE-2012-0057
PHP before 5.3.9 has improper libxslt security settings, which allows remote attackers to create arbitrary files via a crafted XSLT stylesheet that uses the libxslt output extension.
PHP before 5.3.9 has improper libxslt security settings, which allows remote attackers to create arbitrary files via a crafted XSLT stylesheet that uses the libxslt output extension.
CVE-2012-0781
The tidy_diagnose function in PHP 5.3.8 might allow remote attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted input to an application that attempts to perform Tidy::diagnose operations on invalid objects, a different vulnerability than CVE-2011-4153.
The tidy_diagnose function in PHP 5.3.8 might allow remote attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted input to an application that attempts to perform Tidy::diagnose operations on invalid objects, a different vulnerability than CVE-2011-4153.
CVE-2012-0789
Memory leak in the timezone functionality in PHP before 5.3.9 allows remote attackers to cause a denial of service (memory consumption) by triggering many strtotime function calls, which are not properly handled by the php_date_parse_tzfile cache.
Memory leak in the timezone functionality in PHP before 5.3.9 allows remote attackers to cause a denial of service (memory consumption) by triggering many strtotime function calls, which are not properly handled by the php_date_parse_tzfile cache.
CVE-2012-1172
The file-upload implementation in rfc1867.c in PHP before 5.4.0 does not properly handle invalid [ (open square bracket) characters in name values, which makes it easier for remote attackers to cause a denial of service (malformed $_FILES indexes) or conduct directory traversal attacks during multi-file uploads by leveraging a script that lacks its own filename restrictions.
The file-upload implementation in rfc1867.c in PHP before 5.4.0 does not properly handle invalid [ (open square bracket) characters in name values, which makes it easier for remote attackers to cause a denial of service (malformed $_FILES indexes) or conduct directory traversal attacks during multi-file uploads by leveraging a script that lacks its own filename restrictions.
CVE-2012-2336
sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to cause a denial of service (resource consumption) by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'T' case. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1823.
sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to cause a denial of service (resource consumption) by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'T' case. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1823.
CVE-2012-2143
The crypt_des (aka DES-based crypt) function in FreeBSD before 9.0-RELEASE-p2, as used in PHP, PostgreSQL, and other products, does not process the complete cleartext password if this password contains a 0x80 character, which makes it easier for context-dependent attackers to obtain access via an authentication attempt with an initial substring of the intended password, as demonstrated by a Unicode password.
The crypt_des (aka DES-based crypt) function in FreeBSD before 9.0-RELEASE-p2, as used in PHP, PostgreSQL, and other products, does not process the complete cleartext password if this password contains a 0x80 character, which makes it easier for context-dependent attackers to obtain access via an authentication attempt with an initial substring of the intended password, as demonstrated by a Unicode password.
CVE-2012-2386
Integer overflow in the phar_parse_tarfile function in tar.c in the phar extension in PHP before 5.3.14 and 5.4.x before 5.4.4 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted tar file that triggers a heap-based buffer overflow.
Integer overflow in the phar_parse_tarfile function in tar.c in the phar extension in PHP before 5.3.14 and 5.4.x before 5.4.4 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted tar file that triggers a heap-based buffer overflow.
追加情報:
N/A
ダウンロード:
SRPMS
- php-5.3.3-14.AXS4.src.rpm
MD5: 5864b7367eda9cbcf080d4520446eb10
SHA-256: c088a1c88cc0dad495aa3ae17cb2298b4400fd265942c0a856b89cd9af4d3acd
Size: 10.24 MB
Asianux Server 4 for x86
- php-5.3.3-14.AXS4.i686.rpm
MD5: fa6f81fe493ad470c50e708b0894d2b8
SHA-256: 4cbda0af46e158d7305f3138da3cc7918f16f2074dbd9dcd18c7b91b9dec0c00
Size: 1.11 MB - php-bcmath-5.3.3-14.AXS4.i686.rpm
MD5: 074e0091c2027c3f9df2a1aab41c7279
SHA-256: 027a1faa1f88224f70550493cba44f222c012ac9694dc5c4e9aae0837e10132a
Size: 32.10 kB - php-cli-5.3.3-14.AXS4.i686.rpm
MD5: adbe31ff0b0b4bc8f7e24047a6bd6d69
SHA-256: aed241be3c70d48d86758bf3686d4a17ec34d0792b583c6c2b2f1b2da5b6af9f
Size: 2.22 MB - php-common-5.3.3-14.AXS4.i686.rpm
MD5: 96ce3dad21ec004601d143747e2afac0
SHA-256: 4e04de14c548cf70ade2c5653ab7fcdbd424841afb3a4f817bed8d53059c7009
Size: 522.86 kB - php-gd-5.3.3-14.AXS4.i686.rpm
MD5: b64a7d6ac42d3803851a577ebd2cac11
SHA-256: f60e5c384282b445419dd8696e2c47bc89320ac1a034bc4150b16e12d7c4e629
Size: 102.20 kB - php-ldap-5.3.3-14.AXS4.i686.rpm
MD5: 4b4c9ec26f6f396f149ec833316ce1bd
SHA-256: 9c4000459f895ade38d77445b22ce3b6febdc5bf89878cecf877a9eaba696981
Size: 35.12 kB - php-mbstring-5.3.3-14.AXS4.i686.rpm
MD5: 4450b517e197a2fcf113cdf6ca5b897e
SHA-256: f7cc4dcd5064ece5f5f08cb07b35d9020d8b89e8de0a11f78f1f5f0ff0dc4316
Size: 452.50 kB - php-mysql-5.3.3-14.AXS4.i686.rpm
MD5: 60a44c07287f0e1de54c5d46642f27b0
SHA-256: cefdc0dfc1e3858c7943f036826ea07db7d0b30028d308f61b69f189f31e0607
Size: 76.25 kB - php-odbc-5.3.3-14.AXS4.i686.rpm
MD5: 2fd366bb52967015b804e612f2efa9b0
SHA-256: 80c1e0ffb70b94c9c7e2926ed9c35bd34dfa82a059149a458abea640dcacbe5b
Size: 47.66 kB - php-pdo-5.3.3-14.AXS4.i686.rpm
MD5: 0e3561c2c4db81eae0b1f87d44e2a3d9
SHA-256: dfd153c6647cc25f3102446d6beb2c9c99f9b89efbf2156b14e622cddb809e7b
Size: 71.80 kB - php-pgsql-5.3.3-14.AXS4.i686.rpm
MD5: dc245cbcb916b1bf06a27eadddf61d1f
SHA-256: 3206104680588b4a70a2ba340d94235d4e2e7a882306c6750aacd95928146f78
Size: 66.69 kB - php-soap-5.3.3-14.AXS4.i686.rpm
MD5: a0b86ebb8aaea1d41dde7c4c63eed076
SHA-256: 869320c7d285a7de323b3eb6a1147c9b944ae85ec7144d257a64e8f447af763e
Size: 138.79 kB - php-xml-5.3.3-14.AXS4.i686.rpm
MD5: 0f7f98d30cfcacbc3dc934ede8d8cc55
SHA-256: cb8a52650896e1ec620262da6e5b4d573f9464328dfee1774c6086a74934cfa4
Size: 98.80 kB - php-xmlrpc-5.3.3-14.AXS4.i686.rpm
MD5: f42b0ecc4a6e40c22e5c8f058cb30b7c
SHA-256: 1d1362419549669b2d69d0c51d3e4ad224a4752e8bd2c842a832dc2971080398
Size: 50.86 kB
Asianux Server 4 for x86_64
- php-5.3.3-14.AXS4.x86_64.rpm
MD5: 6cb11c8dcd2ccbd0cea63f61a172d262
SHA-256: 8f5389f8da7d1c8d14a484c767336a06a9261b11a7607c992aa84fb6bcf350e2
Size: 1.12 MB - php-bcmath-5.3.3-14.AXS4.x86_64.rpm
MD5: 1b08bf470ce3dac06024ad834806d1b2
SHA-256: f432039da689acef9e67edbdde657f900c60b63dc8209b634d56e7bd20a00954
Size: 31.85 kB - php-cli-5.3.3-14.AXS4.x86_64.rpm
MD5: 97d95afefe0b4aef93508156bcc2d01a
SHA-256: 514cca7beb4e917ec57e04eabc6348c965dcbc9fe683a7ce1cdf4fb4974db315
Size: 2.17 MB - php-common-5.3.3-14.AXS4.x86_64.rpm
MD5: d9f7ade56e2186f98149c8244a3824bf
SHA-256: 3e452ccad9734caeb425ce7543b7d743d8e6d6caa0d729ba4cabae9ee1242edb
Size: 521.65 kB - php-gd-5.3.3-14.AXS4.x86_64.rpm
MD5: b0d62970e5c4204423a9b7e08dc404a0
SHA-256: 3a07705c45b8dd8f79e7417f12b5f75c72cf507ee1c608c2c6d3136e66120970
Size: 103.29 kB - php-ldap-5.3.3-14.AXS4.x86_64.rpm
MD5: ec9c3fc2edcc88567031ffbc3c559977
SHA-256: 3f01919f25cf752bda3e8f3f798944b8696bc289f19dadeedf8749c62935714d
Size: 35.48 kB - php-mbstring-5.3.3-14.AXS4.x86_64.rpm
MD5: 4646144b2b32a70aaa96f2b3b48df43b
SHA-256: 3d4aad911002262f76cf00f75e55148f9899c2f0026ae882a6fe819088316c1a
Size: 452.43 kB - php-mysql-5.3.3-14.AXS4.x86_64.rpm
MD5: 0cd6e2f4186fcb99c60eda522f2fadb8
SHA-256: e5a4c116c61e7876d425cf08abdc911693800cfeeb4d3b9b16ce2a146a789e00
Size: 78.42 kB - php-odbc-5.3.3-14.AXS4.x86_64.rpm
MD5: 02d002a359e7ee60c27593777018f7d3
SHA-256: ebebcb3234c8bfb7ac37f869b98713f06dec7ca7f745fb70b4eb1fbab3cff708
Size: 47.97 kB - php-pdo-5.3.3-14.AXS4.x86_64.rpm
MD5: a2d83bebf7ecca20e0fe506ad7917cd3
SHA-256: 6aa4721b195ab8f09248acb140e0446aef0e1374808c9fd841b8365beb87ea5d
Size: 72.42 kB - php-pgsql-5.3.3-14.AXS4.x86_64.rpm
MD5: bafcbe1f0c216997245d2a574142e365
SHA-256: 7d777f1db2d4c399043a09f233aa84f486cc6b4419eb8fdcd6a87a5949ad25a3
Size: 67.43 kB - php-soap-5.3.3-14.AXS4.x86_64.rpm
MD5: 46ac866b2a36548c4e4a289a297495d5
SHA-256: e0cc7847e4061ad4cd7a898fe2d10b0ac717707fa9b1df5c9829fe25392bd2bc
Size: 137.29 kB - php-xml-5.3.3-14.AXS4.x86_64.rpm
MD5: 5071901fc95974240e9f11fd5e9d36e7
SHA-256: 9168a354b3002c8e5ee50ebc38f44177ea370c36c4037ea357402e14c9db1941
Size: 100.40 kB - php-xmlrpc-5.3.3-14.AXS4.x86_64.rpm
MD5: 5ee3529cf43c62a2d6360f1727b81486
SHA-256: 23f1017be7e6a97957b1737757bb042baef7efd3ac8dfec55c7d404ab729667d
Size: 49.75 kB