Synopsis

Moderate: php security update

Type/Severity

Security Advisory: Moderate

Topic

Updated PHP packages that fix several security issues are now available for
Red Hat Enterprise Linux 3 and 5.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

Description

PHP is an HTML-embedded scripting language commonly used with the Apache
HTTP Web server.

It was discovered that the PHP escapeshellcmd() function did not properly
escape multi-byte characters which are not valid in the locale used by the
script. This could allow an attacker to bypass quoting restrictions imposed
by escapeshellcmd() and execute arbitrary commands if the PHP script was
using certain locales. Scripts using the default UTF-8 locale are not
affected by this issue. (CVE-2008-2051)

PHP functions htmlentities() and htmlspecialchars() did not properly
recognize partial multi-byte sequences. Certain sequences of bytes could be
passed through these functions without being correctly HTML-escaped.
Depending on the browser being used, an attacker could use this flaw to
conduct cross-site scripting attacks. (CVE-2007-5898)

A PHP script which used the transparent session ID configuration option, or
which used the output_add_rewrite_var() function, could leak session
identifiers to external web sites. If a page included an HTML form with an
ACTION attribute referencing a non-local URL, the user's session ID would
be included in the form data passed to that URL. (CVE-2007-5899)

It was discovered that PHP fnmatch() function did not restrict the length
of the string argument. An attacker could use this flaw to crash the PHP
interpreter where a script used fnmatch() on untrusted input data.
(CVE-2007-4782)

It was discovered that PHP did not properly seed its pseudo-random number
generator used by functions such as rand() and mt_rand(), possibly allowing
an attacker to easily predict the generated pseudo-random values.
(CVE-2008-2107, CVE-2008-2108)

Users of PHP should upgrade to these updated packages, which contain
backported patches to correct these issues.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Server 3 x86_64
• Red Hat Enterprise Linux Server 3 ia64
• Red Hat Enterprise Linux Server 3 i386
• Red Hat Enterprise Linux Server - Extended Update Support 5.2 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support 5.2 ia64
• Red Hat Enterprise Linux Server - Extended Update Support 5.2 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Workstation 3 x86_64
• Red Hat Enterprise Linux Workstation 3 ia64
• Red Hat Enterprise Linux Workstation 3 i386
• Red Hat Enterprise Linux Desktop 3 x86_64
• Red Hat Enterprise Linux Desktop 3 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for IBM z Systems 3 s390x
• Red Hat Enterprise Linux for IBM z Systems 3 s390
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 5.2 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux for Power, big endian 3 ppc
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 5.2 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 285881 - CVE-2007-4782 php crash in glob() and fnmatch() functions
• BZ - 382411 - CVE-2007-5898 php htmlentities/htmlspecialchars multibyte sequences
• BZ - 382431 - CVE-2007-5899 php session ID leakage
• BZ - 445006 - CVE-2008-2051 PHP multibyte shell escape flaw
• BZ - 445684 - CVE-2008-2107 PHP 32 bit weak random seed
• BZ - 445685 - CVE-2008-2108 PHP weak 64 bit random seed

CVEs

• CVE-2008-2051
• CVE-2008-2108
• CVE-2007-5898
• CVE-2007-5899
• CVE-2007-4782
• CVE-2008-2107

References

• http://www.redhat.com/security/updates/classification/#moderate

Red Hat Enterprise Linux Server 5

SRPM
x86_64
php-5.1.6-20.el5_2.1.x86_64.rpm	SHA-256: 871d69e2f138b79af38d8eb15e1cc1e0927393f65fea8eca7caf874d9ee89af6
php-bcmath-5.1.6-20.el5_2.1.x86_64.rpm	SHA-256: 5b7cdce3662105fea7c96df76d6197bebdb5a13052776dc84e4b353a733dd767
php-cli-5.1.6-20.el5_2.1.x86_64.rpm	SHA-256: fdabfbbd6014abdb0c6a8313dfd2e50df2036627490b350fd2e3aff665d45ba8
php-common-5.1.6-20.el5_2.1.x86_64.rpm	SHA-256: 72e49e4519d14ca7334318f5bce731875a8f9c29981d3a8eea8fb2c85ca66bef
php-dba-5.1.6-20.el5_2.1.x86_64.rpm	SHA-256: db8fe4ef02f59d3315c6004e6808f03c270bd7c89dd762167cd0412d75ae93da
php-devel-5.1.6-20.el5_2.1.x86_64.rpm	SHA-256: 6b35844828c38b9f70809576c2484b8a522e9c3cc867415dce8e6810cff54210
php-gd-5.1.6-20.el5_2.1.x86_64.rpm	SHA-256: fb624e45625fb6c6ea39a342fdf91c1fb08a4696bb1f7394292a33fdef579e6b
php-imap-5.1.6-20.el5_2.1.x86_64.rpm	SHA-256: 3e2cafd6887972e56209a5b3caeaeea3282ea4772229aaaebc718fb62f77fa91
php-ldap-5.1.6-20.el5_2.1.x86_64.rpm	SHA-256: a45b529b5803e2d17ae7e77dc1e08ee16f76fc1ad8b5fd1dd30d67fb1afd42af
php-mbstring-5.1.6-20.el5_2.1.x86_64.rpm	SHA-256: 1f518d854edd809d210296b23b3609f112f548dbc01842bf8b7de40a20fcc8c2
php-mysql-5.1.6-20.el5_2.1.x86_64.rpm	SHA-256: fb822cee1105a1920a1621531b67640c5b842cc748b6c624460d17a17e472dcc
php-ncurses-5.1.6-20.el5_2.1.x86_64.rpm	SHA-256: b41ff5e452fec5f5c0b10315fac90a0b8e2eebe15218a2e22e66f04cf60e94d7
php-odbc-5.1.6-20.el5_2.1.x86_64.rpm	SHA-256: cf598655068e4a3effdef9c48aa4055656f8625344f7e609f0ba41156ee0d46d
php-pdo-5.1.6-20.el5_2.1.x86_64.rpm	SHA-256: e192f676d0fed7db2626bb2874b08911e729d4d44a6b18d7f57bec418fc2e6bd
php-pgsql-5.1.6-20.el5_2.1.x86_64.rpm	SHA-256: e854882c274c187b9e5e3d65ba306854022040a8f099d1adc3c224b3200bc36d
php-snmp-5.1.6-20.el5_2.1.x86_64.rpm	SHA-256: 7d34fa57aee171b82f8bdfba7f8266e19b5a3c23c2a54a9436a7819ada7f6331
php-soap-5.1.6-20.el5_2.1.x86_64.rpm	SHA-256: bfad41e3bc43941b1d70f132dd334206c7b61a2da3f043bd252cc07a8d9c56fe
php-xml-5.1.6-20.el5_2.1.x86_64.rpm	SHA-256: 0ac75c22dfd56211da989dbd9149e4ac2025b0d21ef9901cd9930525c268e2c9
php-xmlrpc-5.1.6-20.el5_2.1.x86_64.rpm	SHA-256: cbc844d07489bbee3a791c6d8d043850180aa1539cbc5827af009311f7d655be

Red Hat Enterprise Linux Workstation 5

SRPM
x86_64
php-5.1.6-20.el5_2.1.x86_64.rpm	SHA-256: 871d69e2f138b79af38d8eb15e1cc1e0927393f65fea8eca7caf874d9ee89af6
php-bcmath-5.1.6-20.el5_2.1.x86_64.rpm	SHA-256: 5b7cdce3662105fea7c96df76d6197bebdb5a13052776dc84e4b353a733dd767
php-cli-5.1.6-20.el5_2.1.x86_64.rpm	SHA-256: fdabfbbd6014abdb0c6a8313dfd2e50df2036627490b350fd2e3aff665d45ba8
php-common-5.1.6-20.el5_2.1.x86_64.rpm	SHA-256: 72e49e4519d14ca7334318f5bce731875a8f9c29981d3a8eea8fb2c85ca66bef
php-dba-5.1.6-20.el5_2.1.x86_64.rpm	SHA-256: db8fe4ef02f59d3315c6004e6808f03c270bd7c89dd762167cd0412d75ae93da
php-devel-5.1.6-20.el5_2.1.x86_64.rpm	SHA-256: 6b35844828c38b9f70809576c2484b8a522e9c3cc867415dce8e6810cff54210
php-gd-5.1.6-20.el5_2.1.x86_64.rpm	SHA-256: fb624e45625fb6c6ea39a342fdf91c1fb08a4696bb1f7394292a33fdef579e6b
php-imap-5.1.6-20.el5_2.1.x86_64.rpm	SHA-256: 3e2cafd6887972e56209a5b3caeaeea3282ea4772229aaaebc718fb62f77fa91
php-ldap-5.1.6-20.el5_2.1.x86_64.rpm	SHA-256: a45b529b5803e2d17ae7e77dc1e08ee16f76fc1ad8b5fd1dd30d67fb1afd42af
php-mbstring-5.1.6-20.el5_2.1.x86_64.rpm	SHA-256: 1f518d854edd809d210296b23b3609f112f548dbc01842bf8b7de40a20fcc8c2
php-mysql-5.1.6-20.el5_2.1.x86_64.rpm	SHA-256: fb822cee1105a1920a1621531b67640c5b842cc748b6c624460d17a17e472dcc
php-ncurses-5.1.6-20.el5_2.1.x86_64.rpm	SHA-256: b41ff5e452fec5f5c0b10315fac90a0b8e2eebe15218a2e22e66f04cf60e94d7
php-odbc-5.1.6-20.el5_2.1.x86_64.rpm	SHA-256: cf598655068e4a3effdef9c48aa4055656f8625344f7e609f0ba41156ee0d46d
php-pdo-5.1.6-20.el5_2.1.x86_64.rpm	SHA-256: e192f676d0fed7db2626bb2874b08911e729d4d44a6b18d7f57bec418fc2e6bd
php-pgsql-5.1.6-20.el5_2.1.x86_64.rpm	SHA-256: e854882c274c187b9e5e3d65ba306854022040a8f099d1adc3c224b3200bc36d
php-snmp-5.1.6-20.el5_2.1.x86_64.rpm	SHA-256: 7d34fa57aee171b82f8bdfba7f8266e19b5a3c23c2a54a9436a7819ada7f6331
php-soap-5.1.6-20.el5_2.1.x86_64.rpm	SHA-256: bfad41e3bc43941b1d70f132dd334206c7b61a2da3f043bd252cc07a8d9c56fe
php-xml-5.1.6-20.el5_2.1.x86_64.rpm	SHA-256: 0ac75c22dfd56211da989dbd9149e4ac2025b0d21ef9901cd9930525c268e2c9
php-xmlrpc-5.1.6-20.el5_2.1.x86_64.rpm	SHA-256: cbc844d07489bbee3a791c6d8d043850180aa1539cbc5827af009311f7d655be

Red Hat Enterprise Linux Server from RHUI 5

SRPM
x86_64
php-5.1.6-20.el5_2.1.x86_64.rpm	SHA-256: 871d69e2f138b79af38d8eb15e1cc1e0927393f65fea8eca7caf874d9ee89af6
php-bcmath-5.1.6-20.el5_2.1.x86_64.rpm	SHA-256: 5b7cdce3662105fea7c96df76d6197bebdb5a13052776dc84e4b353a733dd767
php-cli-5.1.6-20.el5_2.1.x86_64.rpm	SHA-256: fdabfbbd6014abdb0c6a8313dfd2e50df2036627490b350fd2e3aff665d45ba8
php-common-5.1.6-20.el5_2.1.x86_64.rpm	SHA-256: 72e49e4519d14ca7334318f5bce731875a8f9c29981d3a8eea8fb2c85ca66bef
php-dba-5.1.6-20.el5_2.1.x86_64.rpm	SHA-256: db8fe4ef02f59d3315c6004e6808f03c270bd7c89dd762167cd0412d75ae93da
php-devel-5.1.6-20.el5_2.1.x86_64.rpm	SHA-256: 6b35844828c38b9f70809576c2484b8a522e9c3cc867415dce8e6810cff54210
php-gd-5.1.6-20.el5_2.1.x86_64.rpm	SHA-256: fb624e45625fb6c6ea39a342fdf91c1fb08a4696bb1f7394292a33fdef579e6b
php-imap-5.1.6-20.el5_2.1.x86_64.rpm	SHA-256: 3e2cafd6887972e56209a5b3caeaeea3282ea4772229aaaebc718fb62f77fa91
php-ldap-5.1.6-20.el5_2.1.x86_64.rpm	SHA-256: a45b529b5803e2d17ae7e77dc1e08ee16f76fc1ad8b5fd1dd30d67fb1afd42af
php-mbstring-5.1.6-20.el5_2.1.x86_64.rpm	SHA-256: 1f518d854edd809d210296b23b3609f112f548dbc01842bf8b7de40a20fcc8c2
php-mysql-5.1.6-20.el5_2.1.x86_64.rpm	SHA-256: fb822cee1105a1920a1621531b67640c5b842cc748b6c624460d17a17e472dcc
php-ncurses-5.1.6-20.el5_2.1.x86_64.rpm	SHA-256: b41ff5e452fec5f5c0b10315fac90a0b8e2eebe15218a2e22e66f04cf60e94d7
php-odbc-5.1.6-20.el5_2.1.x86_64.rpm	SHA-256: cf598655068e4a3effdef9c48aa4055656f8625344f7e609f0ba41156ee0d46d
php-pdo-5.1.6-20.el5_2.1.x86_64.rpm	SHA-256: e192f676d0fed7db2626bb2874b08911e729d4d44a6b18d7f57bec418fc2e6bd
php-pgsql-5.1.6-20.el5_2.1.x86_64.rpm	SHA-256: e854882c274c187b9e5e3d65ba306854022040a8f099d1adc3c224b3200bc36d
php-snmp-5.1.6-20.el5_2.1.x86_64.rpm	SHA-256: 7d34fa57aee171b82f8bdfba7f8266e19b5a3c23c2a54a9436a7819ada7f6331
php-soap-5.1.6-20.el5_2.1.x86_64.rpm	SHA-256: bfad41e3bc43941b1d70f132dd334206c7b61a2da3f043bd252cc07a8d9c56fe
php-xml-5.1.6-20.el5_2.1.x86_64.rpm	SHA-256: 0ac75c22dfd56211da989dbd9149e4ac2025b0d21ef9901cd9930525c268e2c9
php-xmlrpc-5.1.6-20.el5_2.1.x86_64.rpm	SHA-256: cbc844d07489bbee3a791c6d8d043850180aa1539cbc5827af009311f7d655be