ID de Prueba:	1.3.6.1.4.1.25623.1.0.58003
Categoría:	Mandrake Local Security Checks
Título:	Mandrake Security Advisory MDKSA-2007:038 (php)
Resumen:	NOSUMMARY
Descripción:	Description: The remote host is missing an update to php announced via advisory MDKSA-2007:038. PHP 5.2.0 and 4.4 allows local users to bypass safe_mode and open_basedir restrictions via a malicious path and a null byte before a in a session_save_path argument, followed by an allowed path, which causes a parsing inconsistency in which PHP validates the allowed path but sets session.save_path to the malicious path. (CVE-2006-6383) Buffer overflow in the gdImageStringFTEx function in gdft.c in GD Graphics Library 2.0.33 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted string with a JIS encoded font. PHP uses an embedded copy of GD and may be susceptible to the same issue. (CVE-2007-0455) Updated packages have been patched to correct these issues. Users must restart Apache for the changes to take effect. Affected: 2006.0, 2007.0, Corporate 3.0, Corporate 4.0, Multi Network Firewall 2.0 Solution: To upgrade automatically use MandrakeUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. https://secure1.securityspace.com/smysecure/catid.html?in=MDKSA-2007:038 Risk factor : High CVSS Score: 7.5
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2006-6383 BugTraq ID: 21508 http://www.securityfocus.com/bid/21508 Bugtraq: 20061208 PHP 5.2.0 session.save_path safe_mode and open_basedir bypass (Google Search) http://www.securityfocus.com/archive/1/453938/30/9270/threaded http://www.mandriva.com/security/advisories?name=MDKSA-2007:038 http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.010.html http://secunia.com/advisories/24022 http://secunia.com/advisories/24514 http://securityreason.com/securityalert/2000 http://securityreason.com/achievement_securityalert/43 SuSE Security Announcement: SUSE-SA:2007:020 (Google Search) http://lists.suse.com/archive/suse-security-announce/2007-Mar/0003.html Common Vulnerability Exposure (CVE) ID: CVE-2007-0455 2007-0007 http://www.trustix.org/errata/2007/0007 20070418 rPSA-2007-0073-1 php php-mysql php-pgsql http://www.securityfocus.com/archive/1/466166/100/0/threaded 22289 http://www.securityfocus.com/bid/22289 23916 http://secunia.com/advisories/23916 24022 24052 http://secunia.com/advisories/24052 24053 http://secunia.com/advisories/24053 24107 http://secunia.com/advisories/24107 24143 http://secunia.com/advisories/24143 24151 http://secunia.com/advisories/24151 24924 http://secunia.com/advisories/24924 24945 http://secunia.com/advisories/24945 24965 http://secunia.com/advisories/24965 25575 http://secunia.com/advisories/25575 29157 http://secunia.com/advisories/29157 42813 http://secunia.com/advisories/42813 ADV-2007-0400 http://www.vupen.com/english/advisories/2007/0400 ADV-2011-0022 http://www.vupen.com/english/advisories/2011/0022 FEDORA-2007-150 http://fedoranews.org/cms/node/2631 FEDORA-2010-19022 http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052854.html FEDORA-2010-19033 http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052848.html MDKSA-2007:035 http://www.mandriva.com/security/advisories?name=MDKSA-2007:035 MDKSA-2007:036 http://www.mandriva.com/security/advisories?name=MDKSA-2007:036 MDKSA-2007:038 MDKSA-2007:109 http://www.mandriva.com/security/advisories?name=MDKSA-2007:109 RHSA-2007:0153 http://www.redhat.com/support/errata/RHSA-2007-0153.html RHSA-2007:0155 http://rhn.redhat.com/errata/RHSA-2007-0155.html RHSA-2007:0162 http://www.redhat.com/support/errata/RHSA-2007-0162.html RHSA-2008:0146 http://www.redhat.com/support/errata/RHSA-2008-0146.html USN-473-1 http://www.ubuntu.com/usn/usn-473-1 [security-announce] 20070208 rPSA-2007-0028-1 gd http://lists.rpath.com/pipermail/security-announce/2007-February/000145.html http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=224607 https://issues.rpath.com/browse/RPL-1030 https://issues.rpath.com/browse/RPL-1268 oval:org.mitre.oval:def:11303 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11303
Copyright	Copyright (c) 2007 E-Soft Inc. http://www.securityspace.com

Esta es sólo una de 146377 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.