Ubuntu 4.10 : php4 vulnerabilities (USN-99-1)
Critical Nessus Plugin ID 20725
SynopsisThe remote Ubuntu host is missing one or more security-related patches.
DescriptionStefano Di Paola discovered integer overflows in PHP's pack() and unpack() functions. A malicious PHP script could exploit these to break out of safe mode and execute arbitrary code with the privileges of the PHP interpreter. (CAN-2004-1018)
Note: The second part of CAN-2004-1018 (buffer overflow in the shmop_write() function) was already fixed in USN-66-1.
Stefan Esser discovered two safe mode bypasses which allowed malicious PHP scripts to circumvent path restrictions. This was possible by either using virtual_popen() with a current directory containing shell metacharacters (CAN-2004-1063) or creating a specially crafted directory whose length exceeded the capacity of the realpath() function (CAN-2004-1064).
Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
SolutionUpdate the affected packages.