To: bugtraq@securityfocus.com
Subject: [ MDVSA-2009:188 ] php4-eaccelerator
Date: Sat, 01 Aug 2009 05:21:00 +0200
From: security@mandriva.com
Reply-To: <xsecurity@mandriva.com.>
Message-Id: <E1MX59Y-0003wt-RX@titan.mandriva.com.>
X-Virus-Scanned: antivirus-gw at tyumen.ru
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2009:188
http://www.mandriva.com/security/
_______________________________________________________________________
Package : php4-eaccelerator
Date : August 1, 2009
Affected: Corporate 4.0
_______________________________________________________________________
Problem Description:
A vulnerability has been found and corrected in php4-eaccelerator:
encoder.php in eAccelerator allows remote attackers to execute
arbitrary code by copying a local executable file to a location under
the web root via the -o option, and then making a direct request to
this file, related to upload of image files (CVE-2009-2353).
Additionally to adressing the security issue this update also provides
php4-eaccelerator 0.9.5.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2353
_______________________________________________________________________
Updated Packages:
Corporate 4.0:
316f952f5c20ac686b85b90663e0fa77 corporate/4.0/i586/php4-eaccelerator-0.9.5-1.1.20060mlcs4.i586.rpm
a5a1897fc80cefe48bb007a79faee847 corporate/4.0/i586/php4-eaccelerator-admin-0.9.5-1.1.20060mlcs4.i586.rpm
ed1eda86b967cb3ee8d7f6792833aa4d corporate/4.0/i586/php4-eaccelerator-eloader-0.9.5-1.1.20060mlcs4.i586.rpm
600f50f507a5027362791c7e5920a163 corporate/4.0/SRPMS/php4-eaccelerator-0.9.5-1.1.20060mlcs4.src.rpm
Corporate 4.0/X86_64:
e9e3ee27351d4a545e3d37272ef89d8f corporate/4.0/x86_64/php4-eaccelerator-0.9.5-1.1.20060mlcs4.x86_64.rpm
d999744cdb5f8325a59a84dd3c478397 corporate/4.0/x86_64/php4-eaccelerator-admin-0.9.5-1.1.20060mlcs4.x86_64.rpm
0f4a2d49182485b26370593bc2bd1dab corporate/4.0/x86_64/php4-eaccelerator-eloader-0.9.5-1.1.20060mlcs4.x86_64.rpm
600f50f507a5027362791c7e5920a163 corporate/4.0/SRPMS/php4-eaccelerator-0.9.5-1.1.20060mlcs4.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iD8DBQFKc4ovmqjQ0CJFipgRAtxWAJ9wvmBP3NFxBZcdLBZwjImePm87XgCgyAVV
YP8t9vYXxJ2dtPhPilQC3eQ=
=W9Py
-----END PGP SIGNATURE-----
