Yellow Dog Linux Security Announcement
--------------------------------------

Package:	php
Issue Date: 	October 20, 2002	
Priority:	high
Advisory ID: 	YDU-20021020-7


1. 	Topic:

	Updated php packages are available.


2. 	Problem:

	"PHP is an HTML-embedded scripting language commonly used with Apache. PHP
	versions 4.0.5 through 4.1.0 in safe mode do not properly cleanse
	the 5th parameter to the mail() function. This vulnerability allows local
	users and possibly remote attackers to execute arbitrary commands via shell
	metacharacters.

	The Common Vulnerabilities and Exposures project (cve.mitre.org) has
	assigned the name CAN-2001-1246 to this issue.

	It is highly recommended that all users of PHP upgrade to these errata
	packages, which are not vulnerable to this issue.

	Please Note:

	This PHP errata enforces memory limits on the size of the PHP process to
	prevent a badly generated script from becoming a possible source for a
	denial of service attack. The default process size is 8Mb though you can
	adjust this as you deem necessary thought the php.ini directive
	memory_limit. For example, to change the process memory limit to 4MB, add
	the following:

	memory_limit 4194304"
	(from Red Had advisory)


3. 	Solution:

   	a) Updating via apt...
   	We suggest that you use the apt-get program to keep your
   	system up-to-date. The following command(s) will retrieve
   	and install the fixed version of this update onto your system:

		apt-get update
		apt-get install php

   	b) Updating manually...
	Download the updates below and then run the following rpm command.
   	(Please use a mirror site)

		rpm -Fvh [filenames]
		ftp://ftp.yellowdoglinux.com/pub/yellowdog/updates/yellowdog-2.3/
			ppc/php-4.1.2-7.3.4.3a.ppc.rpm
			ppc/php-devel-4.1.2-7.3.4.3a.ppc.rpm
			ppc/php-imap-4.1.2-7.3.4.3a.ppc.rpm
			ppc/php-ldap-4.1.2-7.3.4.3a.ppc.rpm
			ppc/php-manual-4.1.2-7.3.4.3a.ppc.rpm
			ppc/php-mysql-4.1.2-7.3.4.3a.ppc.rpm
			ppc/php-odbc-4.1.2-7.3.4.3a.ppc.rpm
			ppc/php-pgsql-4.1.2-7.3.4.3a.ppc.rpm
			ppc/php-snmp-4.1.2-7.3.4.3a.ppc.rpm


4. Verification

MD5 checksum			  Package
--------------------------------  ----------------------------
41df07cf42a82a085a8f0aea42342e6e  ppc/php-4.1.2-7.3.4.3a.ppc.rpm
bcf007894dfd6352d9155ab4fd9a8d58  ppc/php-devel-4.1.2-7.3.4.3a.ppc.rpm
64332bfd4f406a786703db7c68f12fdc  ppc/php-imap-4.1.2-7.3.4.3a.ppc.rpm
aced44a77daa90d97bdf89587d85dd4d  ppc/php-ldap-4.1.2-7.3.4.3a.ppc.rpm
8c60805633e18f79762561f72b2ef73e  ppc/php-manual-4.1.2-7.3.4.3a.ppc.rpm
c58d80a7113a862e35f3547ee556b674  ppc/php-mysql-4.1.2-7.3.4.3a.ppc.rpm
ee1ee277f59a3f696fa379d78f1a815f  ppc/php-odbc-4.1.2-7.3.4.3a.ppc.rpm
b50dfbf7e474de486e413fa11b40019d  ppc/php-pgsql-4.1.2-7.3.4.3a.ppc.rpm
ca2a75753764c31e7b658f2638626d07  ppc/php-snmp-4.1.2-7.3.4.3a.ppc.rpm
03b13fcc6ec2e1aec1138cfbf6f2e158  SRPMS/php-4.1.2-7.3.4.3a.src.rpm


I wish to verify that each package has not been corrupted or tampered with,
examine the md5sum with the following command: rpm --checksig --nogpg filename


5. Misc.

Terra Soft has setup a moderated mailing list where these security, bugfix, and package
enhancement announcements will be posted. See http://lists.terrasoftsolutions.com/ for more
information.

For information regarding the usage of apt-get, see:
http://www.yellowdoglinux.com/support/solutions/ydl_general/apt-get.shtml