MDKSA-2005:238 - Updated php/php-mbstring packages fix mail injection vulnerability

Posted by Bob on: 12/27/2005 10:42 PM [ Print | 0 comment(s) ]

The Mandriva Security Team published a new security update: MDKSA-2005:238 - Updated php/php-mbstring packages fix mail injection vulnerability for Mandriva Linux. Here the announcement:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDKSA-2005:238
http://www.mandriva.com/security/
_______________________________________________________________________

Package : php
Date : December 27, 2005
Affected: 2006.0
_______________________________________________________________________

Problem Description:

A CRLF injection vulnerability in the mb_send_mail function in PHP
before 5.1.0 might allow remote attackers to inject arbitrary
e-mail headers via line feeds (LF) in the "To" address argument, when
using sendmail as the MTA (mail transfer agent).

The updated packages have been patched to address this issue. Once the
new packages have been installed, you will need to restart your Apache
server using "service httpd restart" in order for the new packages to
take effect.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3883
_______________________________________________________________________

Updated Packages:

Mandriva Linux 2006.0:
56df29cd687ea6ebf1cc9a1ae63a57e5 2006.0/RPMS/libphp5_common5-5.0.4-9.2.20060mdk.i586.rpm
a11b5e93d7abf400d2d93960ccca1c5d 2006.0/RPMS/php-cgi-5.0.4-9.2.20060mdk.i586.rpm
fd780d49c9a03ec0f79c1bdc72e731bd 2006.0/RPMS/php-cli-5.0.4-9.2.20060mdk.i586.rpm
ab02893570049594e59ada69226c4c40 2006.0/RPMS/php-devel-5.0.4-9.2.20060mdk.i586.rpm
2034f37afd79db0c9fe9a85638074741 2006.0/RPMS/php-fcgi-5.0.4-9.2.20060mdk.i586.rpm
3c670610b9b775c15b5ff8123053e3d6 2006.0/RPMS/php-mbstring-5.0.4-1.1.20060mdk.i586.rpm
49f649f8e0e6971c9dc57aed47283f33 2006.0/SRPMS/php-5.0.4-9.2.20060mdk.src.rpm
50ff56f7e81807f8b2509b32d0fa779a 2006.0/SRPMS/php-mbstring-5.0.4-1.1.20060mdk.src.rpm

Mandriva Linux 2006.0/X86_64:
97ea04332ebbfed112efeb254dc8ecab x86_64/2006.0/RPMS/lib64php5_common5-5.0.4-9.2.20060mdk.x86_64.rpm
1ceddbff0b0304d86448c8654bed7693 x86_64/2006.0/RPMS/php-cgi-5.0.4-9.2.20060mdk.x86_64.rpm
1782dbfc99e0d183a3bb46723a65f1e2 x86_64/2006.0/RPMS/php-cli-5.0.4-9.2.20060mdk.x86_64.rpm
df10015113a4324d3cf8660723052df1 x86_64/2006.0/RPMS/php-devel-5.0.4-9.2.20060mdk.x86_64.rpm
72771069aaa978f51f0a037f348a2be1 x86_64/2006.0/RPMS/php-fcgi-5.0.4-9.2.20060mdk.x86_64.rpm
145928c34d497040282e6b05fcb53221 x86_64/2006.0/RPMS/php-mbstring-5.0.4-1.1.20060mdk.x86_64.rpm
49f649f8e0e6971c9dc57aed47283f33 x86_64/2006.0/SRPMS/php-5.0.4-9.2.20060mdk.src.rpm
50ff56f7e81807f8b2509b32d0fa779a x86_64/2006.0/SRPMS/php-mbstring-5.0.4-1.1.20060mdk.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
lt;security*mandriva.comgt;
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFDsYT/mqjQ0CJFipgRAvyYAJ45bD4urla+HGZRVUSgcCnFiIxggQCeOJHf
A47hvb6w9oAx+bGup9p2iBU=
=Igz1
-----END PGP SIGNATURE-----