[Secure-testing-commits] r5673 - data

[Moritz Muehlenhoff]

Author: jmm-guest
Date: 2007-04-18 21:09:43 +0000 (Wed, 18 Apr 2007)
New Revision: 5673

Modified:
   data/mopb.txt
Log:
group MOPB file by PHP4/PHP5 status


Modified: data/mopb.txt
===================================================================
--- data/mopb.txt	2007-04-18 21:01:34 UTC (rev 5672)
+++ data/mopb.txt	2007-04-18 21:09:43 UTC (rev 5673)
@@ -1,52 +1,64 @@
-45  PHP ext/filter Email Validation Vulnerability
-TODO(low) -> possible email header injections when coupled with other problems (php5 5.2.0, 5.2.1)
+Issues affecting PHP 4 and PHP 5:
 
-44  PHP 5.2.0 Memory Manager Signed Comparision Vulnerability
-#TODO(medium) -> remotely exploitable via SOAP interfaces, CVE-2007-1889 (php5 5.2.0 only)
-
-42  PHP 5 php_stream_filter_create() Off By One Vulnerablity
-#TODO(medium) -> needs to be fixed, Sarge not affected, CVE-2007-1824 (php5, remote code execution, though haven't reproduced it)
-
 41  PHP 5 sqlite_udf_decode_binary() Buffer Overflow Vulnerability
 #TODO(medium) -> for PHP5, not activated in the PHP4 build, CVE-2007-1887. (php4 & php5, remote code execution)
 
-35  PHP 4 zip_entry_read() Integer Overflow Vulnerability
-#TODO(medium) -> needs to be fixed, CVE-2007-1777 (php4, remote code execution)
-
 34  PHP mail() Header Injection Through Subject and To Parameters
 #TODO(medium) -> needs to be fixed, CVE-2007-1718 (php4 & php5, header injection possible via some MTAs when set to process the headers for recipients)
 
-33  PHP mail() Message ASCIIZ Byte Truncation
-N/A This is a bug, but not security-relevant, CVE-2007-1717 (php4 & php5)
-
-32  PHP 4.4.5/4.4.6 session_decode() Double Free Vulnerability (U) 
-TODO(medium) -> needs to be fixed in php/etch, sarge not affected (php4 4.4.5/4.4.6, remote code execution)
-[MOPB-32-php4.diff]
-
 30  PHP _SESSION unset() Vulnerability
 #TODO(low) -> hard to trigger remotely, CVE-2007-1700. (php4 & php5, code execution)
 
 26  PHP mb_parse_str() register_globals Activation Vulnerability
 #TODO(medium) -> functionally enables register_globals for any future requests, CVE-2007-1583 (php4 & php5, enables stealth register_globals for life of process)
 
-24  PHP array_user_key_compare() Double DTOR Vulnerability
-N/A Only triggerable by malicious script, CVE-2007-1484 (php4 & php5, code execution)
-
 23  PHP 5 Rejected Session Identifier Double Free Vulnerability
 #TODO(medium) -> locally exploitable to gain access to process memory, hard to do remotely, CVE-2007-1522. (php5 5.2.0+, code execution)
 
+10  PHP php_binary Session Deserialization Information Leak  Vulnerability
+#TODO(low) -> Can only leak 127 bytes of data, CVE-2007-1380 (php4 & php5, heap leak)
+Check, to which extent this was covered by our backports of 5.2.1 patches
+
+
+
+Issues affecting PHP 4 only:
+
+35  PHP 4 zip_entry_read() Integer Overflow Vulnerability
+#TODO(medium) -> needs to be fixed, CVE-2007-1777 (php4, remote code execution)
+
+32  PHP 4.4.5/4.4.6 session_decode() Double Free Vulnerability (U) 
+TODO(medium) -> needs to be fixed in php/etch, sarge not affected (php4 4.4.5/4.4.6, remote code execution)
+[MOPB-32-php4.diff]
+
 22  PHP session_regenerate_id() Double Free Vulnerability
 #TODO(medium) -> locally exploitable to gain access to process memory, hard to do remotely, CVE-2007-1521 (php4 & php5, code execution)
 [MOPB-22-php4.diff]
 
+04  PHP 4 unserialize() ZVAL Reference Counter Overflow
+TODO (php4 only, gain execute control)
+[MOPB-04-php4.diff]
+
+
+
+Issues affecting PHP 5 only:
+
+45  PHP ext/filter Email Validation Vulnerability
+TODO(low) -> possible email header injections when coupled with other problems (php5 5.2.0, 5.2.1)
+
+44  PHP 5.2.0 Memory Manager Signed Comparision Vulnerability
+#TODO(medium) -> remotely exploitable via SOAP interfaces, CVE-2007-1889 (php5 5.2.0 only)
+
+42  PHP 5 php_stream_filter_create() Off By One Vulnerablity
+#TODO(medium) -> needs to be fixed, CVE-2007-1824 (php5, remote code execution, though haven't reproduced it)
+
 19 PHP ext/filter Space Trimming Buffer Underflow Vulnerability
-#TODO(medium) -> for PHP5. Sarge not affected. CVE-2007-1453 (php5 5.2.0 only, code execution on big endian)
+#TODO(medium) -> for PHP5. CVE-2007-1453 (php5 5.2.0 only, code execution on big endian)
 
 18  PHP ext/filter HTML Tag Stripping Bypass Vulnerability
-#TODO(medium) -> for PHP5. Sarge not affected. CVE-2007-1453 (php5 5.2.0 only, can avoid filters)
+#TODO(medium) -> for PHP5. CVE-2007-1453 (php5 5.2.0 only, can avoid filters)
 
 17  PHP ext/filter FDF Post Bypass Vulnerability
-#TODO(low) -> ...or possibly "broken as designed". CVE-2007-1452, Sarge is not affected. (php5 5.2.0 only, can avoid filters)
+#TODO(low) -> ...or possibly "broken as designed". CVE-2007-1452, (php5 5.2.0 only, can avoid filters)
 
 16  PHP zip:// URL Wrapper Buffer Overflow Vulnerability
 #TODO(medium) -> possible remote data can result in code execution in 5.2.0 which uses the zip handler, CVE-2007-1399. (php5 5.2.0 only, code execution)
@@ -54,17 +66,13 @@
 14  PHP substr_compare() Information Leak Vulnerability
 #TODO(low) -> corner-case where length+offset > INT_MAX, CVE-2007-1375 (php5, heap leak)
 
-10  PHP php_binary Session Deserialization Information Leak  Vulnerability
-#TODO(low) -> Can only leak 127 bytes of data, CVE-2007-1380 (php4 & php5, heap leak)
-Check, to which extent this was covered by our backports of 5.2.1 patches
 
-04  PHP 4 unserialize() ZVAL Reference Counter Overflow
-TODO (php4 only, gain execute control)
-[MOPB-04-php4.diff]
 
 
+
 Done or resolved:
 
+
 43  PHP msg_receive() Memory Allocation Integer Overflow Vulnerabilty
 #N/A -> Only triggerable by malicious script, CVE-2007-1890 (php4 & php5, local code execution, possibly FreeBSD only)
 
@@ -83,6 +91,9 @@
 36  PHP session.save_path open_basedir Bypass Vulnerability
 #N/A -> open_basedir bypasses not supported, CVE-2007-1461
 
+33  PHP mail() Message ASCIIZ Byte Truncation
+N/A This is a bug, but not security-relevant, CVE-2007-1717 (php4 & php5)
+
 31  PHP _SESSION Deserialization Overwrite Vulnerability
 #N/A -> register_globals not supported, already fixed in DSA-1264, dupe CVE-2007-0910/CVE-2007-1701 (php4 & php5, very hard to trigger remotely, code execution)
 
@@ -98,6 +109,9 @@
 25  PHP header() Space Trimming Buffer Underflow Vulnerability
 #Fixed in Etch as part of the 5.2.1 backport, dupe CVE-2007-0907/CVE-2007-1584
 
+24  PHP array_user_key_compare() Double DTOR Vulnerability
+N/A Only triggerable by malicious script, CVE-2007-1484 (php4 & php5, code execution)
+
 21  PHP compress.bzip2:// URL Wrapper safemode and open_basedir Bypass Vulnerability
 #N/A -> Safemode and open_basedir bypasses not supported, CVE-2007-1461