-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ________________________________________________________________________
OpenPKG Security Advisory The OpenPKG Project http://www.openpkg.org/security.html http://www.openpkg.org [EMAIL PROTECTED] [EMAIL PROTECTED] OpenPKG-SA-2002.001 28-Feb-2002 ________________________________________________________________________ Package: php Vulnerability: remote exploit OpenPKG Specific: no Affected Releases: OpenPKG 1.0 Affected Packages: <= php-4.0.6-1.0.0 Corrected Packages: >= php-4.0.6-1.0.1 Dependent Packages: - Description: According to an e-matters Security Advisory [5] and the PHP Team [6], Stefan Esser <[EMAIL PROTECTED]>, also a member of the PHP team, found several flaws in the way PHP handles multipart/form-data HTTP POST requests (as described in RFC1867), known as POST file uploads. Each of the flaws could allow an attacker to execute arbitrary code on the victim's system. Please check whether you are affected by running "<prefix>/bin/rpm -qa php". If you have the "php" package installed and its version is affected (see above), we recommend that you immediately upgrade it (see Solution). Additionally, we recommend that you rebuild and reinstall all dependent OpenPKG packages, too. [2] Workaround: Perform the following operations to temporarily workaround the security problem (be careful, it deactivates the whole service): $ su - # <prefix>/bin/rpm -e php Solution: Select the updated source RPM appropriate for your OpenPKG release [4], fetch it from the OpenPKG FTP service [3] or a mirror location, verify its integrity [1], build a corresponding binary RPM from it and update your OpenPKG installation by applying the binary RPM [2]. For the latest OpenPKG 1.0 release, perform the following operations to permanently fix the security problem (for other releases adjust accordingly). $ ftp ftp.openpkg.org ftp> bin ftp> cd release/1.0/UPD ftp> get php-4.0.6-1.0.1.src.rpm ftp> bye $ <prefix>/bin/rpm --checksig php-4.0.6-1.0.1.src.rpm $ <prefix>/bin/rpm --rebuild php-4.0.6-1.0.1.src.rpm $ su - # <prefix>/bin/rpm -Fvh <prefix>/RPM/PKG/php-4.0.6-1.0.1.*.rpm ________________________________________________________________________ References: [1] http://www.openpkg.org/security.html#signature [2] http://www.openpkg.org/tutorial.html#regular-source [3] ftp://ftp.openpkg.org/release/1.0/UPD/ [4] ftp://ftp.openpkg.org/release/1.0/UPD/php-4.0.6-1.0.1.src.rpm [5] http://security.e-matters.de/advisories/012002.html [6] http://www.php.net/distributions/rfc1867.c.diff-4.0.6.gz ________________________________________________________________________ For security reasons, this advisory was digitally signed with the OpenPGP public key "OpenPKG <[EMAIL PROTECTED]>" (ID 63C4CB9F) of the OpenPKG project which you can find under the official URL http://www.openpkg.org/openpkg.pgp or on http://keyserver.pgp.com/. To check the integrity of this advisory, verify its digital signature by using GnuPG (http://www.gnupg.org/). For instance, pipe this message to the command "gpg --verify --keyserver keyserver.pgp.com". ________________________________________________________________________ -----BEGIN PGP SIGNATURE----- Comment: OpenPKG <[EMAIL PROTECTED]> iEYEARECAAYFAjyIf9YACgkQgHWT4GPEy58oDgCeJNx8BORx14gfAyi7mi9jZZNy E9EAnRttdn1nZ+BbhbB0LTnXhZwPBugI =OwAy -----END PGP SIGNATURE----- ______________________________________________________________________ The OpenPKG Project www.openpkg.org Project Announcement List [EMAIL PROTECTED]
