__________________________________________________________
The U.S. Department of Energy
Computer Incident Advisory Capability
___ __ __ _ ___
/ | /_\ /
\___ __|__ / \ \___
__________________________________________________________
INFORMATION BULLETIN
Sun Cobalt PHP SafeMode Vulnerability
[Sun Alert ID: 46724]
May 7, 2003 18:00 GMT Number N-091
______________________________________________________________________________
PROBLEM: Sun has identified a vulnerability in PHP SafeMode with the
privileges of the HTTP process. The HTTP process normally runs
as the unprivileged uid 'nobody' (uid 60001).
PLATFORM: Sun Cobalt RaQs and Qubes
DAMAGE: Exploiting this vulnerability could allow local or remote
attackers the ability to execute arbitrary code.
SOLUTION: Apply available patches.
______________________________________________________________________________
VULNERABILITY The risk is HIGH. PHP 4.0.5 through 4.1.0 in safe mode does not
ASSESSMENT: properly cleanse the 5th parameter to the mail() function,
which allows local users and possibly remote attackers to
execute arbitrary commands via shell metacharacters.
______________________________________________________________________________
LINKS:
CIAC BULLETIN: http://www.ciac.org/ciac/bulletins/n-091.shtml
ORIGINAL BULLETIN: http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert%
2F46724&zone_32=category%3Asecurity
PATCHES: http://sunsolve.sun.com/cobalt/
http://ftp.cobalt.sun.com/pub/packages/raq4/eng/RaQ4-All-
Security-2.0.1-15959.pkg
http://ftp.cobalt.sun.com/pub/packages/qube3/ml/Qube3-All-
Security-4.0.1-15959.pkg
http://ftp.cobalt.sun.com/pub/packages/raq550/all/RaQ550-
All-Security-0.0.1-15959.pkg
http://ftp.cobalt.sun.com/pub/packages/raqxtr/eng/RaQXTR-
All-Security-1.0.1-15959.pkg
ftp://ftp.cobalt.sun.com/pub/products/sunlinux/5.0/en/
updates/i386/update_5_0_3/
______________________________________________________________________________
[***** Start Sun Alert ID: 46724 *****]
Sun(sm) Alert Notification
Sun Alert ID: 46724
Synopsis: The PHP on Sun/Cobalt Platforms Have Exploitable Vulnerabilities
Category: Security
Product: Sun Cobalt RaQs and Qubes
BugIDs: 15959
Avoidance: Workaround, Patch
State: Resolved
Date Released: 28-Aug-2002, 06-May-2003
Date Closed: 06-May-2003
Date Modified: 06-May-2003
1. Impact
A local or remote unprivileged user may be able to execute arbitrary code on Sun Cobalt
systems due to a vulnerability in PHP SafeMode with the privileges of the HTTP process.
The HTTP process normally runs as the unprivileged uid 'nobody' (uid 60001). In order
for a remote unprivileged user to exploit this issue, the existing PHP pages must use a
variable as the fifth parameter in the mail() command. The ability to execute arbitrary
code as the unprivileged uid 'nobody' may lead to modified Web content, denial of
service, or further compromise.
Please see the Common Vulnerabilities and Exposures project at http://cve.mitre.org and
reference CAN-2001-1246 at http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-1246.
An additional reference is http://www.iss.net/security_center/static/6787.php.
2. Contributing Factors
This issue can occur in the following releases:
2800 Workgroup NTT/KOBE(2800WGJ-KOBE)
mod_php3-3.0.7-1C3j.mips.rpm
mod_php3-doc-3.0.7-1C3j.mips.rpm
RaQ4 no raid(3001R)
php-4.0.1-C1.i386.rpm
php-devel-4.0.1-C1.i386.rpm
RaQ4 Japanese no raid(3001R-ja)
php-4.0.1-C1.i386.rpm
php-devel-4.0.1-C1.i386.rpm
RaQ4 RAID(3100R)
php-4.0.1-C1.i386.rpm
php-devel-4.0.1-C1.i386.rpm
RaQ4 Japanese RAID(3100R-ja)
php-4.0.1-C1.i386.rpm
php-devel-4.0.1-C1.i386.rpm
RaQ XTR(3500R)
php-4.0.3pl1-C1r5.i386.rpm
php-devel-4.0.3pl1-C1r5.i386.rpm
RaQ XTR Japanese(3500R-ja)
php-4.0.3pl1-C1r5.i386.rpm
php-devel-4.0.3pl1-C1r5.i386.rpm
Qube3(4000WG)
php-4.0.1-C7q3.i386.rpm
php-devel-4.0.1-C5q3.i386.rpm
Qube 3 Japanese(4000WGJ)
php-4.0.3pl1-C1q3.i386.rpm
php-devel-4.0.3pl1-C1q3.i386.rpm
Qube3 w/ Caching(4010WG)
php-4.0.1-C7q3.i386.rpm
php-devel-4.0.1-C5q3.i386.rpm
Qube3 Japanese w/ Caching(4010WGJ)
php-4.0.3pl1-C1q3.i386.rpm
php-devel-4.0.3pl1-C1q3.i386.rpm
Control Station Production(4100CS)
php-4.0.3pl1-C1r6.i386.rpm
php-devel-4.0.3pl1-C1r6.i386.rpm
RaQ 550 (4100R)
php-devel-4.0.6-C4.i386.rpm
php-4.0.6-C4.i386.rpm
Qube3 w/ Caching and RAID(4100WG)
php-4.0.1-C7q3.i386.rpm
php-devel-4.0.1-C5q3.i386.rpm
Qube3 Japanese w/ Caching and RAID(4100WGJ)
php-4.0.3pl1-C1q3.i386.rpm
php-devel-4.0.3pl1-C1q3.i386.rpm
Sun LX50 (Sun Linux 5.0)
php-4.0.6-12.i386.rpm
php-devel-4.0.6-12.i386.rpm
php-imap-4.0.6-12.i386.rpm
php-ldap-4.0.6-12.i386.rpm
php-mysql-4.0.6-12.i386.rpm
php-odbc-4.0.6-12.i386.rpm
php-manual-4.0.6-12.noarch.rpm
Notes: PHP is an HTML-embedded scripting language commonly used with Apache. PHP
versions 4.0.5 through 4.1.0 in safe mode do not properly cleanse the 5th parameter to
the mail() function. This vulnerability allows local users and possibly remote attackers
to execute arbitrary commands via shell metacharacters.
3. Symptoms
Unusual entries in the web server logs could indicate that someone is attempting to gain
entry through this issue. Any abnormal and/or unauthorized system activity, including,
but not limited to, defaced web pages, unknown user accounts appearing on the system,
and abnormal network traffic or listening TCP/UDP ports.
Solution Summary Top
4. Relief/Workaround
Until fixes for these vulnerabilities can be applied, disable all applications (as
mentioned above in Contributing Factors) that use vulnerable implementations of PHP.
5. Resolution
This issue is addressed in the following releases:
Cobalt platform
Patches are available for all affected Cobalt platforms at:
http://sunsolve.sun.com/cobalt/.
For RaQ 4:
http://ftp.cobalt.sun.com/pub/packages/raq4/eng/RaQ4-All-Security-2.0.1-15959.pkg
Qube 3:
http://ftp.cobalt.sun.com/pub/packages/qube3/ml/Qube3-All-Security-4.0.1-15959.pkg
RaQ 550:
http://ftp.cobalt.sun.com/pub/packages/raq550/all/RaQ550-All-Security-0.0.1-15959.pkg
RaQ XTR:
http://ftp.cobalt.sun.com/pub/packages/raqxtr/eng/RaQXTR-All-Security-1.0.1-15959.pkg
Sun LX50 (Sun Linux 5.0):
ftp://ftp.cobalt.sun.com/pub/products/sunlinux/5.0/en/updates/i386/update_5_0_3/
Change History
06-May-2003:
State: Resolved
Updated Resolution section
This Sun Alert notification is being provided to you on an "AS IS" basis. This Sun Alert
notification may contain information provided by third parties. The issues described in
this Sun Alert notification may or may not impact your system(s). Sun makes no
representations, warranties, or guarantees as to the information contained herein. ANY
AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE HEREBY
DISCLAIMED. BY ACCESSING THIS DOCUMENT YOU ACKNOWLEDGE THAT SUN SHALL IN NO EVENT BE
LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES THAT
ARISE OUT OF YOUR USE OR FAILURE TO USE THE INFORMATION CONTAINED HEREIN. This Sun Alert
notification contains Sun proprietary and confidential information. It is being provided
to you pursuant to the provisions of your agreement to purchase services from Sun, or,
if you do not have such an agreement, the Sun.com Terms of Use. This Sun Alert
notification may only be used for the purposes contemplated by these agreements.
[***** End Sun Alert ID: 46724 *****]
_______________________________________________________________________________
CIAC wishes to acknowledge the contributions of Sun Microsystems for the
information contained in this bulletin.
_______________________________________________________________________________
CIAC, the Computer Incident Advisory Capability, is the computer
security incident response team for the U.S. Department of Energy
(DOE) and the emergency backup response team for the National
Institutes of Health (NIH). CIAC is located at the Lawrence Livermore
National Laboratory in Livermore, California. CIAC is also a founding
member of FIRST, the Forum of Incident Response and Security Teams, a
global organization established to foster cooperation and coordination
among computer security teams worldwide.
CIAC services are available to DOE, DOE contractors, and the NIH. CIAC
can be contacted at:
Voice: +1 925-422-8193 (7x24)
FAX: +1 925-423-8002
STU-III: +1 925-423-2604
E-mail: ciac@ciac.org
Previous CIAC notices, anti-virus software, and other information are
available from the CIAC Computer Security Archive.
World Wide Web: http://www.ciac.org/
Anonymous FTP: ftp.ciac.org
PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing
communities receive CIAC bulletins. If you are not part of these
communities, please contact your agency's response team to report
incidents. Your agency's team will coordinate with CIAC. The Forum of
Incident Response and Security Teams (FIRST) is a world-wide
organization. A list of FIRST member organizations and their
constituencies can be obtained via WWW at http://www.first.org/.
This document was prepared as an account of work sponsored by an
agency of the United States Government. Neither the United States
Government nor the University of California nor any of their
employees, makes any warranty, express or implied, or assumes any
legal liability or responsibility for the accuracy, completeness, or
usefulness of any information, apparatus, product, or process
disclosed, or represents that its use would not infringe privately
owned rights. Reference herein to any specific commercial products,
process, or service by trade name, trademark, manufacturer, or
otherwise, does not necessarily constitute or imply its endorsement,
recommendation or favoring by the United States Government or the
University of California. The views and opinions of authors expressed
herein do not necessarily state or reflect those of the United States
Government or the University of California, and shall not be used for
advertising or product endorsement purposes.
LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC)
N-081: Microsoft Cumulative Patch for Outlook Express
N-082: Microsoft Cumulative Patch for Internet Explorer (IE)
N-083: Cisco Catalyst Enable Password Bypass Vulnerability
N-084: SGI nsd LDAP Implementation Vulnerability
N-085: Oracle Buffer Overflow in Net Services for Oracle Database Server
N-086: HP Tru64 UNIX Software Installation and Update Utilities Vulnerability
N-087: Microsoft Cumulative Patch for BizTalk Server
N-088: Hewlett-Packard rexec Command Security Vulnerability
N-089: Red Hat MySQL Vulnerabilities
N-090: Red Hat mod_auth_any Vulnerabilities
TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2025 AOH
