Detections
Analytics

Mandriva Linux Security Advisory : php (MDVSA-2009:285)

high Nessus Plugin ID 42199

Synopsis

The remote Mandriva Linux host is missing one or more security updates.

Description

Multiple vulnerabilities has been found and corrected in php :

The _gdGetColors function in gd_gd.c in PHP 5.2.11 and 5.3.0, and the GD Graphics Library 2.x, does not properly verify a certain colorsTotal structure member, which might allow remote attackers to conduct buffer overflow or buffer over-read attacks via a crafted GD file, a different vulnerability than CVE-2009-3293. NOTE: some of these details are obtained from third-party information (CVE-2009-3546).

The tempnam function in ext/standard/file.c in PHP 5.2.11 and earlier, and 5.3.x before 5.3.1, allows context-dependent attackers to bypass safe_mode restrictions, and create files in group-writable or world-writable directories, via the dir and prefix arguments (CVE-2009-3557).

The posix_mkfifo function in ext/posix/posix.c in PHP 5.2.11 and earlier, and 5.3.x before 5.3.1, allows context-dependent attackers to bypass open_basedir restrictions, and create FIFO files, via the pathname and mode arguments, as demonstrated by creating a .htaccess file (CVE-2009-3558).

Additionally on CS4 a regression was found and fixed when using the gd-bundled.so variant from the php-gd package.

This update fixes these vulnerabilities.

Solution

Update the affected packages.

Plugin Details

Severity: High

ID: 42199

File Name: mandriva_MDVSA-2009-285.nasl

Version: 1.15

Type: local

Published: 10/22/2009

Updated: 1/6/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: High

Base Score: 9.3

Temporal Score: 6.9

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: p-cpe:/a:mandriva:linux:lib64php5_common5, p-cpe:/a:mandriva:linux:libphp5_common5, p-cpe:/a:mandriva:linux:php-bcmath, p-cpe:/a:mandriva:linux:php-bz2, p-cpe:/a:mandriva:linux:php-calendar, p-cpe:/a:mandriva:linux:php-cgi, p-cpe:/a:mandriva:linux:php-cli, p-cpe:/a:mandriva:linux:php-ctype, p-cpe:/a:mandriva:linux:php-curl, p-cpe:/a:mandriva:linux:php-dba, p-cpe:/a:mandriva:linux:php-dbase, p-cpe:/a:mandriva:linux:php-devel, p-cpe:/a:mandriva:linux:php-dom, p-cpe:/a:mandriva:linux:php-exif, p-cpe:/a:mandriva:linux:php-fcgi, p-cpe:/a:mandriva:linux:php-filter, p-cpe:/a:mandriva:linux:php-ftp, p-cpe:/a:mandriva:linux:php-gd, p-cpe:/a:mandriva:linux:php-gettext, p-cpe:/a:mandriva:linux:php-xmlreader, p-cpe:/a:mandriva:linux:php-xmlrpc, p-cpe:/a:mandriva:linux:php-xmlwriter, p-cpe:/a:mandriva:linux:php-xsl, p-cpe:/a:mandriva:linux:php-zip, p-cpe:/a:mandriva:linux:php-zlib, cpe:/o:mandriva:linux:2009.0, cpe:/o:mandriva:linux:2009.1, p-cpe:/a:mandriva:linux:php-gmp, p-cpe:/a:mandriva:linux:php-hash, p-cpe:/a:mandriva:linux:php-iconv, p-cpe:/a:mandriva:linux:php-imap, p-cpe:/a:mandriva:linux:php-json, p-cpe:/a:mandriva:linux:php-ldap, p-cpe:/a:mandriva:linux:php-mbstring, p-cpe:/a:mandriva:linux:php-mcrypt, p-cpe:/a:mandriva:linux:php-mhash, p-cpe:/a:mandriva:linux:php-mime_magic, p-cpe:/a:mandriva:linux:php-ming, p-cpe:/a:mandriva:linux:php-mssql, p-cpe:/a:mandriva:linux:php-mysql, p-cpe:/a:mandriva:linux:php-mysqli, p-cpe:/a:mandriva:linux:php-ncurses, p-cpe:/a:mandriva:linux:php-odbc, p-cpe:/a:mandriva:linux:php-openssl, p-cpe:/a:mandriva:linux:php-pcntl, p-cpe:/a:mandriva:linux:php-pdo, p-cpe:/a:mandriva:linux:php-pdo_dblib, p-cpe:/a:mandriva:linux:php-pdo_mysql, p-cpe:/a:mandriva:linux:php-pdo_odbc, p-cpe:/a:mandriva:linux:php-pdo_pgsql, p-cpe:/a:mandriva:linux:php-pdo_sqlite, p-cpe:/a:mandriva:linux:php-pgsql, p-cpe:/a:mandriva:linux:php-posix, p-cpe:/a:mandriva:linux:php-pspell, p-cpe:/a:mandriva:linux:php-readline, p-cpe:/a:mandriva:linux:php-recode, p-cpe:/a:mandriva:linux:php-session, p-cpe:/a:mandriva:linux:php-shmop, p-cpe:/a:mandriva:linux:php-snmp, p-cpe:/a:mandriva:linux:php-soap, p-cpe:/a:mandriva:linux:php-sockets, p-cpe:/a:mandriva:linux:php-sqlite, p-cpe:/a:mandriva:linux:php-sybase, p-cpe:/a:mandriva:linux:php-sysvmsg, p-cpe:/a:mandriva:linux:php-sysvsem, p-cpe:/a:mandriva:linux:php-sysvshm, p-cpe:/a:mandriva:linux:php-tidy, p-cpe:/a:mandriva:linux:php-tokenizer, p-cpe:/a:mandriva:linux:php-wddx, p-cpe:/a:mandriva:linux:php-xml

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 10/20/2009

Reference Information

CVE: CVE-2009-3546, CVE-2009-3557, CVE-2009-3558

BID: 36712

CWE: 264

MDVSA: 2009:285