PHP4 vulnerabilities

May 4, 2005

A security issue affects the following Ubuntu releases:

Ubuntu 4.10 (Warty Warthog)

The following packages are affected:

libapache2-mod-php4
php4-cgi

The problem can be corrected by upgrading the affected package to
version 4:4.3.8-3ubuntu7.8. After performing a standard system upgrade
you need to reload the PHP module in the webserver by executing

sudo /etc/init.d/apache2 reload

to effect the necessary changes.

Details follow:

An integer overflow was discovered in the exif_process_IFD_TAG()
function in PHP4’s EXIF module. EXIF tags with a specially crafted
“Image File Directory” (IFD) tag caused a buffer overflow which could
have been exploited to execute arbitrary code with the privileges of
the PHP4 server. (CAN-2005-1042)

The same module also contained a Denial of Service vulnerability. EXIF
headers with a large IFD nesting level caused an unbound recursion
which would eventually overflow the stack and cause the executed
program to crash. (CAN-2005-1043)

In web applications that automatically process EXIF tags of uploaded
images, both vulnerabilities could be exploited remotely.

PHP4 vulnerabilities

Posted in Exploits and Bugs