Mandrake Linux Security Advisory : php (MDKSA-2005:238)

medium Nessus Plugin ID 20469

Synopsis

The remote Mandrake Linux host is missing one or more security updates.

Description

A CRLF injection vulnerability in the mb_send_mail function in PHP before 5.1.0 might allow remote attackers to inject arbitrary e-mail headers via line feeds (LF) in the 'To' address argument, when using sendmail as the MTA (mail transfer agent).

The updated packages have been patched to address this issue. Once the new packages have been installed, you will need to restart your Apache server using 'service httpd restart' in order for the new packages to take effect.

Solution

Update the affected packages.

Plugin Details

Severity: Medium

ID: 20469

File Name: mandrake_MDKSA-2005-238.nasl

Version: 1.14

Type: local

Family: Mandriva Local Security Checks

Published: 1/15/2006

Updated: 1/6/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 2.7

CVSS v2

Risk Factor: Medium

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N

Vulnerability Information

CPE: p-cpe:/a:mandriva:linux:lib64php5_common5, p-cpe:/a:mandriva:linux:libphp5_common5, p-cpe:/a:mandriva:linux:php-cgi, p-cpe:/a:mandriva:linux:php-cli, p-cpe:/a:mandriva:linux:php-devel, p-cpe:/a:mandriva:linux:php-fcgi, p-cpe:/a:mandriva:linux:php-mbstring, cpe:/o:mandriva:linux:2006

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list

Patch Publication Date: 12/27/2005

Reference Information

CVE: CVE-2005-3883

MDKSA: 2005:238

Detections

Analytics