Debian Bug report logs - #354683
PHP4 in Sarge appears vulnerable to CVE-2006-0207

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: "Nick Jenkins" <nickpj@gmail.com>

To: submit@bugs.debian.org

Subject: PHP4 in Sarge appears vulnerable to CVE-2006-0207

Date: Tue, 28 Feb 2006 15:29:16 +1100

Package: php4
Version: 4:4.3.10-16
Severity: normal
Tags: security

Ref:
  http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0207

Description:
  Multiple HTTP response splitting vulnerabilities in PHP 5.1.1 allow remote
 attackers to inject arbitrary HTTP headers via a crafted Set-Cookie header,
 related to the (1) session extension (aka ext/session) and the (2) header
 function.

Vulnerable PHP versions:
  CVE report lists 5.1.1, however versions prior to PHP version 4.4.2
are also vulnerable according to:
http://www.frsirt.com/english/advisories/2006/0177

Message #12 received at 354683@bugs.debian.org (full text, mbox, reply):

From: Iosif Peterfi <iosif.peterfi@fortesys.ro>

To: 354683@bugs.debian.org

Subject: sid

Date: Fri, 07 Apr 2006 18:16:28 +0300

Debian 3.1 sid stable is affected ? If it is, when will be patched ?

Message #17 received at 354683@bugs.debian.org (full text, mbox, reply):

From: Iosif Peterfi <iosif.peterfi@fortesys.ro>

To: 354683@bugs.debian.org

Subject: typo

Date: Fri, 07 Apr 2006 18:21:14 +0300

i meant Debian stable (sarge)

Message #24 received at 354683@bugs.debian.org (full text, mbox, reply):

From: Moritz Naumann <info@moritz-naumann.com>

To: 354683@bugs.debian.org

Subject: PHP 4.3.10-16 (sarge) remains vulnerable to CVE-2006-0207

Date: Tue, 15 Aug 2006 02:09:43 +0200

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi!

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=354683;msg=19
and
http://idssi.enyo.de/tracker/CVE-2006-0207
claim CVE-2006-0207 would not apply to sarges' 4.3.10-16. However, it
does apply.

The false assumption that the advisory by Stefan Esser (Hardened PHP) at
http://www.hardened-php.net/advisory_012006.112.html would cover both
vectors of CVE-2006-0207, has likely led to an incorrect conclusion of
assuming that CVE-2006-0207 would not affect sarge. However, by my
understanding, this advisory only covers the session injection vector
(vector 1 as mentioned in CVE-2006-0207), not the header() injection
issue (vector 2 as mentioned in CVE-2006-0207) which affects upstream
PHP4 < 4.4.2 and PHP5 < 5.1.2, and also affects sarges' 4.3.10-16.


PoC:

echo '<?php header("Location: http://example.org/".$_GET["x"]); ?>' \
> /var/www/header.php

Then direct your web browser to
http://MYDEFAULTHOST/header.php?x=%0d%0aLocation:%20javascript:alert(0);%0d%0aContent-Type:%20text/html%0d%0a%0d%0a%3Cscript%3Ealert(0);%3C/script%3EVulnerable%20PHP%20version%20detected.%3C!--
(obviously, replace MYDEFAULTHOST by whatever (virtual)host you can
access this script through).
If vulnerable, this should return one or two javascript warnings saying
'0' or a client (not PHP!) error with most HTTP clients. You should also
see a page saying "Vulnerable PHP version detected." if you're vulnerable.

Moritz
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (GNU/Linux)

iD8DBQFE4RDHn6GkvSd/BgwRAkqpAKCVi+1XydxeVv9JIEHz7SHVz2bDwQCdFx90
t2YSPZOcP4PKl8g057KJGcU=
=exFc
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.