=========================================================== Ubuntu Security Notice USN-147-1 July 05, 2005 php4, php4-universe vulnerability CAN-2005-1921 =========================================================== A security issue affects the following Ubuntu releases: Ubuntu 4.10 (Warty Warthog) Ubuntu 5.04 (Hoary Hedgehog) The following packages are affected: libapache2-mod-php4 php4-pear The problem can be corrected by upgrading the affected package to version 4:4.3.8-3ubuntu7.9 (for Ubuntu 4.10), or 4:4.3.10-10ubuntu3.1 (for Ubuntu 5.04). In general, a standard system upgrade is sufficient to effect the necessary changes. Details follow: A remote code execution vulnerability has been discovered in the XMLRPC module of the PEAR (PHP Extension and Application Repository) extension of PHP. By sending specially crafted XMLRPC requests to an affected web server, a remote attacker could exploit this to execute arbitrary code with the web server's privileges. In Ubuntu 5.04 (Hoary Hedgehog), the PEAR extension is unsupported (it is contained in the php4-universe package which is part of universe). However, since this is a highly critical vulnerability, that package was fixed as well. Please note that many applications contain a copy of the affected XMLRPC code, which must be fixed separately. The following packages may also be affected, but are unsupported in Ubuntu: - drupal - wordpress - phpwiki - horde3 - ewiki - egroupware - phpgroupware These packages might be fixed by the community later. The following common third party applications are affected as well, but not packaged for Ubuntu: - Serendipity - Postnuke - tikiwiki - phpwebsite If you run any affected software, please upgrade them as soon as possible to protect your server. Updated packages for Ubuntu 4.10 (Warty Warthog): Source archives: http://security.ubuntu.com/ubuntu/pool/main/p/php4/php4_4.3.8-3ubuntu7.9.diff.gz Size/MD5: 616004 aba83c3005406218f315dd4e10fdc93c http://security.ubuntu.com/ubuntu/pool/main/p/php4/php4_4.3.8-3ubuntu7.9.dsc Size/MD5: 1624 5f13453ccdc07ef678393948887d1fb5 http://security.ubuntu.com/ubuntu/pool/main/p/php4/php4_4.3.8.orig.tar.gz Size/MD5: 4832570 dd69f8c89281f088eadf4ade3dbd39ee Architecture independent packages: http://security.ubuntu.com/ubuntu/pool/main/p/php4/php4-dev_4.3.8-3ubuntu7.9_all.deb Size/MD5: 332280 b4620c776b0b7a0c01e07785276bcc74 http://security.ubuntu.com/ubuntu/pool/universe/p/php4/php4-pear_4.3.8-3ubuntu7.9_all.deb Size/MD5: 333464 37e8baf6cfecda800559359076a98c07 amd64 architecture (Athlon64, Opteron, EM64T Xeon) http://security.ubuntu.com/ubuntu/pool/main/p/php4/libapache2-mod-php4_4.3.8-3ubuntu7.9_amd64.deb Size/MD5: 1689172 ca905ba66abc007c6e2c1f2522f5f867 http://security.ubuntu.com/ubuntu/pool/main/p/php4/php4-cgi_4.3.8-3ubuntu7.9_amd64.deb Size/MD5: 3198276 0b746adc73c7f024307595d751d1046a http://security.ubuntu.com/ubuntu/pool/universe/p/php4/php4-curl_4.3.8-3ubuntu7.9_amd64.deb Size/MD5: 17278 1d8408cd9a09f8f84bdae47b73049255 http://security.ubuntu.com/ubuntu/pool/universe/p/php4/php4-domxml_4.3.8-3ubuntu7.9_amd64.deb Size/MD5: 40436 ce1f94a062c11e6a04f5d63b3ccafce1 http://security.ubuntu.com/ubuntu/pool/universe/p/php4/php4-gd_4.3.8-3ubuntu7.9_amd64.deb Size/MD5: 33496 31cbb8a956114af8f70eb2d501534bab http://security.ubuntu.com/ubuntu/pool/universe/p/php4/php4-ldap_4.3.8-3ubuntu7.9_amd64.deb Size/MD5: 21232 4a9ba4b1ac4ce2d5c2c3c3f2d7311506 http://security.ubuntu.com/ubuntu/pool/universe/p/php4/php4-mcal_4.3.8-3ubuntu7.9_amd64.deb Size/MD5: 18410 8b519ef4c7952bbaf470bed187d53bc2 http://security.ubuntu.com/ubuntu/pool/universe/p/php4/php4-mhash_4.3.8-3ubuntu7.9_amd64.deb Size/MD5: 8000 a8449358e45b69dba6a7a75d2d5699e2 http://security.ubuntu.com/ubuntu/pool/universe/p/php4/php4-mysql_4.3.8-3ubuntu7.9_amd64.deb Size/MD5: 23112 fc767c3fe309f0294428521b1933c2b4 http://security.ubuntu.com/ubuntu/pool/universe/p/php4/php4-odbc_4.3.8-3ubuntu7.9_amd64.deb Size/MD5: 28326 57c9957a11dab6d52888f82f8f80be46 http://security.ubuntu.com/ubuntu/pool/universe/p/php4/php4-recode_4.3.8-3ubuntu7.9_amd64.deb Size/MD5: 7624 19d130845dc8b370e13870c6eabd5720 http://security.ubuntu.com/ubuntu/pool/universe/p/php4/php4-snmp_4.3.8-3ubuntu7.9_amd64.deb Size/MD5: 12984 b468564f7250de1d749a8e057eb01462 http://security.ubuntu.com/ubuntu/pool/universe/p/php4/php4-sybase_4.3.8-3ubuntu7.9_amd64.deb Size/MD5: 21512 7605bfe517943cafa076db8551ad1e99 http://security.ubuntu.com/ubuntu/pool/universe/p/php4/php4-xslt_4.3.8-3ubuntu7.9_amd64.deb Size/MD5: 17254 79257012aa4b000fe9fa82cfe985ed43 http://security.ubuntu.com/ubuntu/pool/universe/p/php4/php4_4.3.8-3ubuntu7.9_amd64.deb Size/MD5: 1705048 8dfe9363fb64f2f4a70758958ca31ca4 i386 architecture (x86 compatible Intel/AMD) http://security.ubuntu.com/ubuntu/pool/main/p/php4/libapache2-mod-php4_4.3.8-3ubuntu7.9_i386.deb Size/MD5: 1631046 aef628ebbe8c897192f7267eb1b808cc http://security.ubuntu.com/ubuntu/pool/main/p/php4/php4-cgi_4.3.8-3ubuntu7.9_i386.deb Size/MD5: 3044388 ab4e7c5e83103c0d2827578552335187 http://security.ubuntu.com/ubuntu/pool/universe/p/php4/php4-curl_4.3.8-3ubuntu7.9_i386.deb Size/MD5: 16846 b230772ca3c791ed8c8e64cce99f0772 http://security.ubuntu.com/ubuntu/pool/universe/p/php4/php4-domxml_4.3.8-3ubuntu7.9_i386.deb Size/MD5: 35560 c7a9dd11f0ad13391a344ce4b6ec8911 http://security.ubuntu.com/ubuntu/pool/universe/p/php4/php4-gd_4.3.8-3ubuntu7.9_i386.deb Size/MD5: 31072 84478ec67c20782309a42b815d88f569 http://security.ubuntu.com/ubuntu/pool/universe/p/php4/php4-ldap_4.3.8-3ubuntu7.9_i386.deb Size/MD5: 19478 f3708205eec173f7ae3fe933d663cac3 http://security.ubuntu.com/ubuntu/pool/universe/p/php4/php4-mcal_4.3.8-3ubuntu7.9_i386.deb Size/MD5: 17056 c094f672d7d58fc4eb612c8edebb3f95 http://security.ubuntu.com/ubuntu/pool/universe/p/php4/php4-mhash_4.3.8-3ubuntu7.9_i386.deb Size/MD5: 7744 9a2e465e18275fb4e73db17da4881479 http://security.ubuntu.com/ubuntu/pool/universe/p/php4/php4-mysql_4.3.8-3ubuntu7.9_i386.deb Size/MD5: 20904 0f277ef545109d5d7652eb67aa3325f6 http://security.ubuntu.com/ubuntu/pool/universe/p/php4/php4-odbc_4.3.8-3ubuntu7.9_i386.deb Size/MD5: 26072 3b1ffa2d29510b6f9bee35593a52f515 http://security.ubuntu.com/ubuntu/pool/universe/p/php4/php4-recode_4.3.8-3ubuntu7.9_i386.deb Size/MD5: 7378 f4ee9b9a7a87d678d5078ac1744eb938 http://security.ubuntu.com/ubuntu/pool/universe/p/php4/php4-snmp_4.3.8-3ubuntu7.9_i386.deb Size/MD5: 12320 29a8a019226abf3179b0e9d37de562ab http://security.ubuntu.com/ubuntu/pool/universe/p/php4/php4-sybase_4.3.8-3ubuntu7.9_i386.deb Size/MD5: 20010 7dcd47e759aa3284414428560be8b028 http://security.ubuntu.com/ubuntu/pool/universe/p/php4/php4-xslt_4.3.8-3ubuntu7.9_i386.deb Size/MD5: 15876 97afbfac4a0cf0f5d65bca298d192947 http://security.ubuntu.com/ubuntu/pool/universe/p/php4/php4_4.3.8-3ubuntu7.9_i386.deb Size/MD5: 1645632 d2d832b255a76a171a3c0e92358f6621 powerpc architecture (Apple Macintosh G3/G4/G5) http://security.ubuntu.com/ubuntu/pool/main/p/php4/libapache2-mod-php4_4.3.8-3ubuntu7.9_powerpc.deb Size/MD5: 1690950 93573b05ce973a986622355a61b62bc1 http://security.ubuntu.com/ubuntu/pool/main/p/php4/php4-cgi_4.3.8-3ubuntu7.9_powerpc.deb Size/MD5: 3203746 1e6bb821114d2a9759ace2ccd228b045 http://security.ubuntu.com/ubuntu/pool/universe/p/php4/php4-curl_4.3.8-3ubuntu7.9_powerpc.deb Size/MD5: 19082 1149a05fe9335225786afa7039c9c1fd http://security.ubuntu.com/ubuntu/pool/universe/p/php4/php4-domxml_4.3.8-3ubuntu7.9_powerpc.deb Size/MD5: 38284 b45719d38cd9e41a358da86e12a3358f http://security.ubuntu.com/ubuntu/pool/universe/p/php4/php4-gd_4.3.8-3ubuntu7.9_powerpc.deb Size/MD5: 34006 c0cac2a45d7da077d3948a34e1c3bd33 http://security.ubuntu.com/ubuntu/pool/universe/p/php4/php4-ldap_4.3.8-3ubuntu7.9_powerpc.deb Size/MD5: 21474 c383448d08c39bbf468f090877a8dbb0 http://security.ubuntu.com/ubuntu/pool/universe/p/php4/php4-mcal_4.3.8-3ubuntu7.9_powerpc.deb Size/MD5: 19304 7d23e82a5c991f40641814cec3fa023f http://security.ubuntu.com/ubuntu/pool/universe/p/php4/php4-mhash_4.3.8-3ubuntu7.9_powerpc.deb Size/MD5: 9320 a4469b0c5c68c837ea196c44fe186af0 http://security.ubuntu.com/ubuntu/pool/universe/p/php4/php4-mysql_4.3.8-3ubuntu7.9_powerpc.deb Size/MD5: 22678 71501b4952953e215c736c68f32c0678 http://security.ubuntu.com/ubuntu/pool/universe/p/php4/php4-odbc_4.3.8-3ubuntu7.9_powerpc.deb Size/MD5: 28406 5718a5a9f91cce77c7be1b089c10dca7 http://security.ubuntu.com/ubuntu/pool/universe/p/php4/php4-recode_4.3.8-3ubuntu7.9_powerpc.deb Size/MD5: 9008 10f220191ff32538b4a0f1b6871e835f http://security.ubuntu.com/ubuntu/pool/universe/p/php4/php4-snmp_4.3.8-3ubuntu7.9_powerpc.deb Size/MD5: 14328 ca81b4fd4df4f67a6e1511fb4a4c66c7 http://security.ubuntu.com/ubuntu/pool/universe/p/php4/php4-sybase_4.3.8-3ubuntu7.9_powerpc.deb Size/MD5: 22192 1e3c119de37fef26225631959df16a21 http://security.ubuntu.com/ubuntu/pool/universe/p/php4/php4-xslt_4.3.8-3ubuntu7.9_powerpc.deb Size/MD5: 18060 9293dd511f251c830753ffbc3e74247e http://security.ubuntu.com/ubuntu/pool/universe/p/php4/php4_4.3.8-3ubuntu7.9_powerpc.deb Size/MD5: 1708946 ee126506d0023696b488d463d59923b4 Updated universe packages for Ubuntu 5.04 (Hoary Hedgehog): Source archives: http://security.ubuntu.com/ubuntu/pool/universe/p/php4-universe/php4-universe_4.3.10-10ubuntu3.1.diff.gz Size/MD5: 269682 c95d409b39acfd20354ab6bad8b34aea http://security.ubuntu.com/ubuntu/pool/universe/p/php4-universe/php4-universe_4.3.10-10ubuntu3.1.dsc Size/MD5: 1669 7d76d8e0b2aab57aca1e18f61d1f6ce1 http://security.ubuntu.com/ubuntu/pool/universe/p/php4-universe/php4-universe_4.3.10.orig.tar.gz Size/MD5: 4892209 73f5d1f42e34efa534a09c6091b5a21e Architecture independent packages: http://security.ubuntu.com/ubuntu/pool/universe/p/php4-universe/php4-pear_4.3.10-10ubuntu3.1_all.deb Size/MD5: 249512 dd075880e8c84a3f6ca86d27a87f079e amd64 architecture (Athlon64, Opteron, EM64T Xeon) http://security.ubuntu.com/ubuntu/pool/universe/p/php4-universe/libapache-mod-php4_4.3.10-10ubuntu3.1_amd64.deb Size/MD5: 1659024 1ce063ab45dc418a22431f84d695e4b0 http://security.ubuntu.com/ubuntu/pool/universe/p/php4-universe/php4-curl_4.3.10-10ubuntu3.1_amd64.deb Size/MD5: 17808 4da475770cbd42f1c071d41c494188b8 http://security.ubuntu.com/ubuntu/pool/universe/p/php4-universe/php4-domxml_4.3.10-10ubuntu3.1_amd64.deb Size/MD5: 40782 278f335641e96382fd2939ed9fbcc6a7 http://security.ubuntu.com/ubuntu/pool/universe/p/php4-universe/php4-gd_4.3.10-10ubuntu3.1_amd64.deb Size/MD5: 34264 4da35e109647012fcfde24f49552bcd0 http://security.ubuntu.com/ubuntu/pool/universe/p/php4-universe/php4-imap_4.3.10-10ubuntu3.1_amd64.deb Size/MD5: 37628 7beb533d0875713c5f32e929300873aa http://security.ubuntu.com/ubuntu/pool/universe/p/php4-universe/php4-ldap_4.3.10-10ubuntu3.1_amd64.deb Size/MD5: 21386 95c19c2109a87323e2db9f7b6b2b963c http://security.ubuntu.com/ubuntu/pool/universe/p/php4-universe/php4-mcal_4.3.10-10ubuntu3.1_amd64.deb Size/MD5: 18864 ed029458bb75d930f5eded7bdebf42c8 http://security.ubuntu.com/ubuntu/pool/universe/p/php4-universe/php4-mhash_4.3.10-10ubuntu3.1_amd64.deb Size/MD5: 8230 255b3a2437187a623951cc247125c204 http://security.ubuntu.com/ubuntu/pool/universe/p/php4-universe/php4-mysql_4.3.10-10ubuntu3.1_amd64.deb Size/MD5: 23522 27069dc0b9e18e0f00028cdecd9e5052 http://security.ubuntu.com/ubuntu/pool/universe/p/php4-universe/php4-odbc_4.3.10-10ubuntu3.1_amd64.deb Size/MD5: 28760 cc1112d462d62b87bdfc12a6e699b76b http://security.ubuntu.com/ubuntu/pool/universe/p/php4-universe/php4-recode_4.3.10-10ubuntu3.1_amd64.deb Size/MD5: 7892 01c7bc557d520fc62e707b6057c35cdf http://security.ubuntu.com/ubuntu/pool/universe/p/php4-universe/php4-snmp_4.3.10-10ubuntu3.1_amd64.deb Size/MD5: 13656 dcd0b09085a96fd2fd1ae282a1fe1183 http://security.ubuntu.com/ubuntu/pool/universe/p/php4-universe/php4-sybase_4.3.10-10ubuntu3.1_amd64.deb Size/MD5: 22428 acd62a8fabe4f825e8bbcd71dd0c4d58 http://security.ubuntu.com/ubuntu/pool/universe/p/php4-universe/php4-universe-common_4.3.10-10ubuntu3.1_amd64.deb Size/MD5: 124338 ffe18168230bd360df7ce16669a2bfc3 http://security.ubuntu.com/ubuntu/pool/universe/p/php4-universe/php4-xslt_4.3.10-10ubuntu3.1_amd64.deb Size/MD5: 17554 fa7e07ceebf5386055df1f91c62b859f i386 architecture (x86 compatible Intel/AMD) http://security.ubuntu.com/ubuntu/pool/universe/p/php4-universe/libapache-mod-php4_4.3.10-10ubuntu3.1_i386.deb Size/MD5: 1592446 707e21f8e3cb343d953d10038e6c97b6 http://security.ubuntu.com/ubuntu/pool/universe/p/php4-universe/php4-curl_4.3.10-10ubuntu3.1_i386.deb Size/MD5: 17364 61a15c5e34802afa5fc2f4328bacbfde http://security.ubuntu.com/ubuntu/pool/universe/p/php4-universe/php4-domxml_4.3.10-10ubuntu3.1_i386.deb Size/MD5: 35924 48080f5998fd89cb63f012f4e5030a77 http://security.ubuntu.com/ubuntu/pool/universe/p/php4-universe/php4-gd_4.3.10-10ubuntu3.1_i386.deb Size/MD5: 31610 82d4dc9766c1cd2e8669b6872dc41443 http://security.ubuntu.com/ubuntu/pool/universe/p/php4-universe/php4-imap_4.3.10-10ubuntu3.1_i386.deb Size/MD5: 36212 246f5877d7381d158ee68da6084ed52e http://security.ubuntu.com/ubuntu/pool/universe/p/php4-universe/php4-ldap_4.3.10-10ubuntu3.1_i386.deb Size/MD5: 19614 b913361fdafec3dd8db84553f799e0c7 http://security.ubuntu.com/ubuntu/pool/universe/p/php4-universe/php4-mcal_4.3.10-10ubuntu3.1_i386.deb Size/MD5: 17400 450607a9e057c297705d453dd5d55a8f http://security.ubuntu.com/ubuntu/pool/universe/p/php4-universe/php4-mhash_4.3.10-10ubuntu3.1_i386.deb Size/MD5: 7982 fc89feabb82a9d888a265a00e4f6664e http://security.ubuntu.com/ubuntu/pool/universe/p/php4-universe/php4-mysql_4.3.10-10ubuntu3.1_i386.deb Size/MD5: 21246 93f63d10d78ffbd76eaff7218b9b7d6c http://security.ubuntu.com/ubuntu/pool/universe/p/php4-universe/php4-odbc_4.3.10-10ubuntu3.1_i386.deb Size/MD5: 26386 0a25c1544d59224390b6f27a2eecdad8 http://security.ubuntu.com/ubuntu/pool/universe/p/php4-universe/php4-recode_4.3.10-10ubuntu3.1_i386.deb Size/MD5: 7628 2ab8973f0df75b9aade1ac38b5e16602 http://security.ubuntu.com/ubuntu/pool/universe/p/php4-universe/php4-snmp_4.3.10-10ubuntu3.1_i386.deb Size/MD5: 12950 49a5b6f4bb7cf93305d24af4a3637946 http://security.ubuntu.com/ubuntu/pool/universe/p/php4-universe/php4-sybase_4.3.10-10ubuntu3.1_i386.deb Size/MD5: 20814 2658a05663d67a91fc216e9a3bd8d02b http://security.ubuntu.com/ubuntu/pool/universe/p/php4-universe/php4-universe-common_4.3.10-10ubuntu3.1_i386.deb Size/MD5: 124336 50b2a7fb1f550bffb48b95b422f898b9 http://security.ubuntu.com/ubuntu/pool/universe/p/php4-universe/php4-xslt_4.3.10-10ubuntu3.1_i386.deb Size/MD5: 16128 593ffa1f9ad80c737a92aeb40ecd3fc7 powerpc architecture (Apple Macintosh G3/G4/G5) http://security.ubuntu.com/ubuntu/pool/universe/p/php4-universe/libapache-mod-php4_4.3.10-10ubuntu3.1_powerpc.deb Size/MD5: 1659224 69742857d6663d339cedebb407d067b1 http://security.ubuntu.com/ubuntu/pool/universe/p/php4-universe/php4-curl_4.3.10-10ubuntu3.1_powerpc.deb Size/MD5: 19622 ae98a7fa9dddb9aed8904ee0dc22548f http://security.ubuntu.com/ubuntu/pool/universe/p/php4-universe/php4-domxml_4.3.10-10ubuntu3.1_powerpc.deb Size/MD5: 38644 36110e98b5082ef8f061fa1b372e9db3 http://security.ubuntu.com/ubuntu/pool/universe/p/php4-universe/php4-gd_4.3.10-10ubuntu3.1_powerpc.deb Size/MD5: 34508 a51a2814ec40e7a7975e8b067359c4c4 http://security.ubuntu.com/ubuntu/pool/universe/p/php4-universe/php4-imap_4.3.10-10ubuntu3.1_powerpc.deb Size/MD5: 37690 5fc59fca49e04d9a80a1037761264baf http://security.ubuntu.com/ubuntu/pool/universe/p/php4-universe/php4-ldap_4.3.10-10ubuntu3.1_powerpc.deb Size/MD5: 21388 323d9d15c74b23bacb9f03396fd19f00 http://security.ubuntu.com/ubuntu/pool/universe/p/php4-universe/php4-mcal_4.3.10-10ubuntu3.1_powerpc.deb Size/MD5: 19716 5fe02ca3292206337b92b2055bd83c1f http://security.ubuntu.com/ubuntu/pool/universe/p/php4-universe/php4-mhash_4.3.10-10ubuntu3.1_powerpc.deb Size/MD5: 9562 d35a225e1e6e62896ea143cbbd0ee47e http://security.ubuntu.com/ubuntu/pool/universe/p/php4-universe/php4-mysql_4.3.10-10ubuntu3.1_powerpc.deb Size/MD5: 23018 ca861573b6f71711b6be19f33281b579 http://security.ubuntu.com/ubuntu/pool/universe/p/php4-universe/php4-odbc_4.3.10-10ubuntu3.1_powerpc.deb Size/MD5: 28660 e1b4401b903b3c6d4b820efa311157d4 http://security.ubuntu.com/ubuntu/pool/universe/p/php4-universe/php4-recode_4.3.10-10ubuntu3.1_powerpc.deb Size/MD5: 9266 b4a3aa306f992f8d1bf40d7a9c26af06 http://security.ubuntu.com/ubuntu/pool/universe/p/php4-universe/php4-snmp_4.3.10-10ubuntu3.1_powerpc.deb Size/MD5: 14950 d4d41593b653b89b460ce913fc404742 http://security.ubuntu.com/ubuntu/pool/universe/p/php4-universe/php4-sybase_4.3.10-10ubuntu3.1_powerpc.deb Size/MD5: 23038 6501ba86450496dc6005d12de9eb8fb9 http://security.ubuntu.com/ubuntu/pool/universe/p/php4-universe/php4-universe-common_4.3.10-10ubuntu3.1_powerpc.deb Size/MD5: 124350 134a58a05ba4939e32e00d6abe6db286 http://security.ubuntu.com/ubuntu/pool/universe/p/php4-universe/php4-xslt_4.3.10-10ubuntu3.1_powerpc.deb Size/MD5: 18256 01c05bf4a68f681bd340f213bb14744a
Attachment:
signature.asc
Description: Digital signature