what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Mandriva Linux Security Advisory 2005.238

Mandriva Linux Security Advisory 2005.238
Posted Dec 28, 2005
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory - A CRLF injection vulnerability in the mb_send_mail function in PHP before 5.1.0 might allow remote attackers to inject arbitrary e-mail headers via line feeds (LF) in the "To" address argument, when using sendmail as the MTA (mail transfer agent).

tags | advisory, remote, arbitrary, php
systems | linux, mandriva
SHA-256 | 1782882c8205876d1db951ca810d0fc801afaa59174c5a22677905bc9045eeea

Mandriva Linux Security Advisory 2005.238

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDKSA-2005:238
http://www.mandriva.com/security/
_______________________________________________________________________

Package : php
Date : December 27, 2005
Affected: 2006.0
_______________________________________________________________________

Problem Description:

A CRLF injection vulnerability in the mb_send_mail function in PHP
before 5.1.0 might allow remote attackers to inject arbitrary
e-mail headers via line feeds (LF) in the "To" address argument, when
using sendmail as the MTA (mail transfer agent).

The updated packages have been patched to address this issue. Once the
new packages have been installed, you will need to restart your Apache
server using "service httpd restart" in order for the new packages to
take effect.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3883
_______________________________________________________________________

Updated Packages:

Mandriva Linux 2006.0:
56df29cd687ea6ebf1cc9a1ae63a57e5 2006.0/RPMS/libphp5_common5-5.0.4-9.2.20060mdk.i586.rpm
a11b5e93d7abf400d2d93960ccca1c5d 2006.0/RPMS/php-cgi-5.0.4-9.2.20060mdk.i586.rpm
fd780d49c9a03ec0f79c1bdc72e731bd 2006.0/RPMS/php-cli-5.0.4-9.2.20060mdk.i586.rpm
ab02893570049594e59ada69226c4c40 2006.0/RPMS/php-devel-5.0.4-9.2.20060mdk.i586.rpm
2034f37afd79db0c9fe9a85638074741 2006.0/RPMS/php-fcgi-5.0.4-9.2.20060mdk.i586.rpm
3c670610b9b775c15b5ff8123053e3d6 2006.0/RPMS/php-mbstring-5.0.4-1.1.20060mdk.i586.rpm
49f649f8e0e6971c9dc57aed47283f33 2006.0/SRPMS/php-5.0.4-9.2.20060mdk.src.rpm
50ff56f7e81807f8b2509b32d0fa779a 2006.0/SRPMS/php-mbstring-5.0.4-1.1.20060mdk.src.rpm

Mandriva Linux 2006.0/X86_64:
97ea04332ebbfed112efeb254dc8ecab x86_64/2006.0/RPMS/lib64php5_common5-5.0.4-9.2.20060mdk.x86_64.rpm
1ceddbff0b0304d86448c8654bed7693 x86_64/2006.0/RPMS/php-cgi-5.0.4-9.2.20060mdk.x86_64.rpm
1782dbfc99e0d183a3bb46723a65f1e2 x86_64/2006.0/RPMS/php-cli-5.0.4-9.2.20060mdk.x86_64.rpm
df10015113a4324d3cf8660723052df1 x86_64/2006.0/RPMS/php-devel-5.0.4-9.2.20060mdk.x86_64.rpm
72771069aaa978f51f0a037f348a2be1 x86_64/2006.0/RPMS/php-fcgi-5.0.4-9.2.20060mdk.x86_64.rpm
145928c34d497040282e6b05fcb53221 x86_64/2006.0/RPMS/php-mbstring-5.0.4-1.1.20060mdk.x86_64.rpm
49f649f8e0e6971c9dc57aed47283f33 x86_64/2006.0/SRPMS/php-5.0.4-9.2.20060mdk.src.rpm
50ff56f7e81807f8b2509b32d0fa779a x86_64/2006.0/SRPMS/php-mbstring-5.0.4-1.1.20060mdk.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFDsYT/mqjQ0CJFipgRAvyYAJ45bD4urla+HGZRVUSgcCnFiIxggQCeOJHf
A47hvb6w9oAx+bGup9p2iBU=
=Igz1
-----END PGP SIGNATURE-----
Login or Register to add favorites

File Archive:

September 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    23 Files
  • 2
    Sep 2nd
    12 Files
  • 3
    Sep 3rd
    0 Files
  • 4
    Sep 4th
    0 Files
  • 5
    Sep 5th
    10 Files
  • 6
    Sep 6th
    8 Files
  • 7
    Sep 7th
    30 Files
  • 8
    Sep 8th
    14 Files
  • 9
    Sep 9th
    26 Files
  • 10
    Sep 10th
    0 Files
  • 11
    Sep 11th
    0 Files
  • 12
    Sep 12th
    5 Files
  • 13
    Sep 13th
    28 Files
  • 14
    Sep 14th
    15 Files
  • 15
    Sep 15th
    17 Files
  • 16
    Sep 16th
    9 Files
  • 17
    Sep 17th
    0 Files
  • 18
    Sep 18th
    0 Files
  • 19
    Sep 19th
    12 Files
  • 20
    Sep 20th
    15 Files
  • 21
    Sep 21st
    20 Files
  • 22
    Sep 22nd
    13 Files
  • 23
    Sep 23rd
    12 Files
  • 24
    Sep 24th
    0 Files
  • 25
    Sep 25th
    0 Files
  • 26
    Sep 26th
    30 Files
  • 27
    Sep 27th
    0 Files
  • 28
    Sep 28th
    0 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close