|
|
Info |
Last Modified |
| 8 months ago |
|
|
|
|
Description |
A flaw exists in PHP which may allow an attacker to add arbitrary data to headers constructed by PHP when remote resources are referenced using these functions. In this way, a PHP script which uses the vulnerable function with the allow_url_fopen() directive enabled may be turned into a proxy, since the attacker is able to construct an arbitrary header to be sent with the request. This may be accomplished by building an arbitrary header using CRLF injection.
|
|
Classification |
Unknown or Incomplete
|
|
Solution |
It is possible to mitigate this issue by disabling the "allow_url_fopen" directive in the PHP configuration. It is also possible to sanitize variables used as URLs in the vulnerable functions using the following regular expression:
$var = preg_replace('/\s+/', ', $var);
The vendor has made a source code fix available via the CVS repository.
Mandrake has released a new security advisory, (MDKSA-2003:082). Information on obtaining and applying fixes can be found in the referenced advisory.
OpenPKG has released a new security advisory, OpenPKG-SA-2003.032. Information on obtaining and applying fixes can be found in the referenced advisory.
Conectiva has released an advisory (CLA-2002:545) which contains fixes for this issue. Please see the attached advisory for further details on obtaining fixes.
RedHat has released a security advisory, RHSA-2002:213-06. Information on obtaining and applying fixes can be found in the referenced advisory.
HP has released an advisory for HP Secure OS, and has advised users to upgrade using the packages listed in Red Hat Security Advisory RHSA-2002:213-06.
|
|
Products |
|
PHP
 |
3.0 |
4.0.3 |
4.0.4 |
4.0.5 |
4.0.6 |
4.0.7 |
4.1.1 |
4.1.2 |
4.2.0 |
4.2.1 |
4.2.2 |
4.2.3 |
|
|
|
|
|
|
Credit |
Unknown or Incomplete
|
|
BlogsProvided by Technorati
|
None found at this time
|
|
|
