A flaw exists in PHP which may allow an attacker to add arbitrary data to headers constructed by PHP when remote resources are referenced using these functions. In this way, a PHP script which uses the vulnerable function with the allow_url_fopen() directive enabled may be turned into a proxy, since the attacker is able to construct an arbitrary header to be sent with the request. This may be accomplished by building an arbitrary header using CRLF injection.

Unknown or Incomplete

It is possible to mitigate this issue by disabling the "allow_url_fopen" directive in the PHP configuration. It is also possible to sanitize variables used as URLs in the vulnerable functions using the following regular expression:

$var = preg_replace('/\s+/', ', $var);

The vendor has made a source code fix available via the CVS repository.

Mandrake has released a new security advisory, (MDKSA-2003:082). Information on obtaining and applying fixes can be found in the referenced advisory.

OpenPKG has released a new security advisory, OpenPKG-SA-2003.032. Information on obtaining and applying fixes can be found in the referenced advisory.

Conectiva has released an advisory (CLA-2002:545) which contains fixes for this issue. Please see the attached advisory for further details on obtaining fixes.

RedHat has released a security advisory, RHSA-2002:213-06. Information on obtaining and applying fixes can be found in the referenced advisory.

HP has released an advisory for HP Secure OS, and has advised users to upgrade using the packages listed in Red Hat Security Advisory RHSA-2002:213-06.

• CVE ID: 2002-0986 (see also: NVD)
• Related OSVDB ID: 2111
• CERT VU: 410609
• Bugtraq ID: 5562 5681
• ISS X-Force ID: 9959
• Other Advisory URL: ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2003-008.0.txt http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000545
  http://www.debian.org/security/2002/dsa-168
  http://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:082
  http://www.novell.com/linux/security/advisories/2002_036_modphp4.html
• Mail List Post: http://marc.theaimsgroup.com/?l=bugtraq&m=103011916928204&w=2
  http://marc.theaimsgroup.com/?l=bugtraq&m=103011916928204&w=2
• Generic Informational URL: http://www.securityfocus.com/advisories/4486
  http://www.securityfocus.com/advisories/4699
  http://www.securityfocus.com/advisories/5056
• Vendor Specific Advisory URL: https://rhn.redhat.com/errata/RHSA-2002.html
• RedHat RHSA: RHSA-2002:213 RHSA-2002:214 RHSA-2002:243 RHSA-2002:244 RHSA-2002:248 RHSA-2003:159

Unknown or Incomplete