CVE-2006-4625 Vulnerability not fixed on libapache2-mod-php4.3.10-20

1 msg	Roland Lichti ist außer Haus.
13 msg	iptables and nmap
11 msg	Package management and security
1 msg	Parte del diario del coronel
4 msg	Re: PERSONAL LOAN - KTA
1 msg	Security features of Debian
1 msg	Wolfgang Rest/SALZBURG/PGV ist außer Haus.
3 msg	Security features of Debian Etch?
1 msg	Restrict remote access by time?
1 msg	Re: [SECURITY] [DSA 1297-1] New gforge-plugin-s...
1 msg	For Your Kind Attention

CVE-2006-4625 Vulnerability not fixed on libapa...
\ Etienne Carriere (18 May 2007)
. \ Florian Weimer (18 May 2007)

1 msg	Administre su pymes - Maximice sus ganancias
1 msg	Re: [SECURITY] [DSA 1293-1] New quagga packages...
2 msg	Re: [SECURITY] [DSA 1292-1] New qt4-x11 package...
5 msg	Re: [SECURITY] [DSA 1291-1] New samba packages ...
6 msg	debian.org DNSs allow unrestricted zone transfers
1 msg	Re: [SECURITY] [DSA 1289-1] New Linux 2.6.18 pa...
10 msg	security mirror out of date: 128.101.240.212
15 msg	spooky windows script

Subject:	CVE-2006-4625 Vulnerability not fixed on libapache2-mod-php4.3.10-20
Group:	Debian-security
From:	Etienne Carriere
Date:	18 May 2007

I discovered yesterday that on a server it is possible to override the
php_admin_value statements .After some researches,this correspond to the
CVE-2006-4625 vulnerability.I search in the DSA between Sept 2006 and
nowadays and I found no quotation about the fixation of the hole for php4 .

You will find attached a patch to this hole .

Best Regards,

Etienne Carriere

P.S : As I did not know the right manner to report a security bug, I
also open an BTS entry : #424937 .

--- Zend/zend_ini.c.old 2007-05-18 18:52:20.000000000 +0200
+++ Zend/zend_ini.c 2007-05-18 18:52:59.000000000 +0200
@@ -241,8 +241,8 @@
{
zend_ini_entry *ini_entry;
TSRMLS_FETCH();
-
- if (zend_hash_find(EG(ini_directives), name, name_length, (void **) &ini_entry)==FAILURE) {
+ if (zend_hash_find(EG(ini_directives), name, name_length, (void**) &ini_entry)==FAILURE ||
+ (stage == ZEND_INI_STAGE_RUNTIME && (ini_entry->modifyable & ZEND_INI_USER) == 0)){
return FAILURE;
}