PHP contains a flaw that allows an attacker to bypass protection against HTTP response splitting attacks. This flaw exists because the sapi_header_op function in main/SAPI.c does not properly handle %0D sequences. This may allow an attacker to bypass protection against the insertion of arbitrary HTTP headers, which are included in a response sent to the server. If an application does not properly filter such a request, it could be used to inject additional headers that manipulate cookies, authentication status, or more.

Upgrade to version 5.3.11 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

• Security Tracker: 1027463
• CVE ID: 2011-1398 (see also: NVD) 2012-4388 (see also: NVD)
• Secunia Advisory ID: 50725
• Other Advisory URL: http://article.gmane.org/gmane.comp.php.devel/70584
  http://openwall.com/lists/oss-security/2012/08/29/5
  http://openwall.com/lists/oss-security/2012/09/02/1
  http://openwall.com/lists/oss-security/2012/09/05/15
  http://openwall.com/lists/oss-security/2012/09/07/3
  https://bugs.php.net/bug.php?id=60227
• Generic Informational URL: http://en.wikipedia.org/wiki/HTTP_response_splitting
• Vendor Specific News/Changelog Entry: http://security-tracker.debian.org/tracker/CVE-2011-1398
  http://security-tracker.debian.org/tracker/CVE-2012-4388
  http://svn.php.net/viewvc/php/php-src/branches/PHP_5_4/main/SAPI.c?r1=323986&r2=323985&pathrev=323986
  http://www.gentoo.org/security/en/glsa/glsa-201209-03.xml
  http://www.php.net/ChangeLog-5.php
  https://bugs.php.net/bug.php?id=60227

• Not Available