-----BEGIN PGP SIGNED MESSAGE-----



=============================================================================

FreeBSD-SA-00:75                                           Security Advisory

                                                                FreeBSD, Inc.



Topic:          mod_php3/mod_php4 allows remote code execution



Category:       ports

Module:         mod_php3/mod_php4

Announced:      2000-11-20

Credits:        Jouko Pynnönen 

Affects:        Ports collection prior to the correction date.

Corrected:      2000-10-12 (mod_php4), 2000-10-18 (mod_php3)

Vendor status:  Updated version released

FreeBSD only:   NO



I.   Background



php is a commonly used HTML-embedded scripting language.



II.  Problem Description



The mod_php ports, versions prior to 3.0.17 (mod_php3) and 4.0.3

(mod_php4), contain a potential vulnerablilty that may allow a

malicious remote user to execute arbitrary code as the user running

the web server, typically user 'nobody'.  The vulnerability is due to

a format string vulnerability in the error logging routines.



A web server is vulnerable if error logging is enabled in php.ini.

Additionally, individual php scripts may cause the web server to be

vulnerable if the script uses the syslog() php function regardless of

error logging in php.ini.



The mod_php ports are not installed by default, nor are they "part of

FreeBSD" as such: it is part of the FreeBSD ports collection, which

contains over 4100 third-party applications in a ready-to-install

format.  The ports collections shipped with FreeBSD 3.5.1 and 4.1.1

contain this problem since it was discovered after the releases, but

it was corrected prior to the release of FreeBSD 4.2.



FreeBSD makes no claim about the security of these third-party

applications, although an effort is underway to provide a security

audit of the most security-critical ports.



III. Impact



Malicious remote users can execute arbitrary code on the local system

as the user running the webserver (typically user 'nobody').  This

vulnerability requires error logging to be enabled in php.ini or by

using the syslog() php function in a script.



If you have not chosen to install the mod_php3 or mod_php4

port/package, then your system is not vulnerable to this problem.



IV.  Workaround



Deinstall the mod_php3/mod_php4 port/package, if you you have

installed it.



V.   Solution



One of the following:



1) Upgrade your entire ports collection and rebuild the

mod_php3/mod_php4 port.



2) Deinstall the old package and install a new package dated after the

correction date, obtained from:



[php3]



http://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-3-stable/www/mod_php-3.0.17.tgz

http://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/www/mod_php-3.0.17.tgz

http://ftp.FreeBSD.org/pub/FreeBSD/ports/alpha/packages-4-stable/www/mod_php-3.0.17.tgz

http://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/www/mod_php-3.0.17.tgz

http://ftp.FreeBSD.org/pub/FreeBSD/ports/alpha/packages-5-current/www/mod_php-3.0.17.tgz



[php4]



http://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-3-stable/www/mod_php-4.0.3pl1.tgz

http://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/www/mod_php-4.0.3pl1.tgz

http://ftp.FreeBSD.org/pub/FreeBSD/ports/alpha/packages-4-stable/www/mod_php-4.0.3pl1.tgz

http://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/www/mod_php-4.0.3pl1.tgz

http://ftp.FreeBSD.org/pub/FreeBSD/ports/alpha/packages-5-current/www/mod_php-4.0.3pl1.tgz



3) download a new port skeleton for the mod_php3/mod_php4 port from:



http://www.freebsd.org/ports/



and use it to rebuild the port.



4) Use the portcheckout utility to automate option (3) above. The

portcheckout port is available in /usr/ports/devel/portcheckout or the

package can be obtained from:



http://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-3-stable/devel/portcheckout-2.0.tgz

http://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/devel/portcheckout-2.0.tgz

http://ftp.FreeBSD.org/pub/FreeBSD/ports/alpha/packages-4-stable/devel/portcheckout-2.0.tgz

http://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/devel/portcheckout-2.0.tgz

http://ftp.FreeBSD.org/pub/FreeBSD/ports/alpha/packages-5-current/devel/portcheckout-2.0.tgz



-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1.0.4 (FreeBSD)

Comment: For info see http://www.gnupg.org



iQCVAwUBOhmWdlUuHi5z0oilAQHlCQP/W+MsHrhJbBEg8JRhw5ZoGh8DI/KHD6gT

PYgaIhr72vmHYN7xtkuHDxV1C5O15YC+z7CzZseYvpdfBDVDm3qKwBQdN5EuumQg

09LHPZEwayLYlgdRmoRQiP8OGsrYER29sYFQZlKvf8ZJw4tZkwJKPmpGBO5bxvSk

+N5lbHKNdHw=

=gy7y

-----END PGP SIGNATURE-----