Vulnerabilities > CVE-2004-1065
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
COMPLETE Integrity impact
COMPLETE Availability impact
COMPLETE Summary
Buffer overflow in the exif_read_data function in PHP before 4.3.10 and PHP 5.x up to 5.0.2 allows remote attackers to execute arbitrary code via a long section name in an image file.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 3 | |
| Application | Php
| 57 |
| OS | 3 | |
| OS | 2 |
Nessus
NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2005-032.NASL description Updated php packages that fix various security issues are now available for Red Hat Enterprise Linux 4. This update has been rated as having important security impact by the Red Hat Security Response Team. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server. Flaws including possible information disclosure, double free, and negative reference index array underflow were found in the deserialization code of PHP. PHP applications may use the unserialize function on untrusted user data, which could allow a remote attacker to gain access to memory or potentially execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1019 to this issue. A flaw in the exif extension of PHP was found which lead to a stack overflow. An attacker could create a carefully crafted image file in such a way which, if parsed by a PHP script using the exif extension, could cause a crash or potentially execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1065 to this issue. Flaws were found in shmop_write, pack, and unpack PHP functions. These functions are not normally passed user-supplied data, so would require a malicious PHP script to be exploited. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1018 to this issue. Users of PHP should upgrade to these updated packages, which contain fixes for these issues. last seen 2020-06-01 modified 2020-06-02 plugin id 17166 published 2005-02-22 reporter This script is Copyright (C) 2005-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/17166 title RHEL 4 : php (RHSA-2005:032) NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_D47E9D19501611D99B5F0050569F0001.NASL description Secunia reports : Multiple vulnerabilities have been reported in PHP, which can be exploited to gain escalated privileges, bypass certain security restrictions, gain knowledge of sensitive information, or compromise a vulnerable system. last seen 2020-06-01 modified 2020-06-02 plugin id 19133 published 2005-07-13 reporter This script is Copyright (C) 2005-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/19133 title FreeBSD : php -- multiple vulnerabilities (d47e9d19-5016-11d9-9b5f-0050569f0001) NASL family MacOS X Local Security Checks NASL id MACOSX_SECUPD2005-001.NASL description he remote host is missing Security Update 2005-001. This security update contains a number of fixes for the following programs : - at commands - ColorSync - libxml2 - Mail - PHP - Safari - SquirrelMail These programs have multiple vulnerabilities which may allow a remote attacker to execute arbitrary code. last seen 2020-06-01 modified 2020-06-02 plugin id 16251 published 2005-01-26 reporter This script is Copyright (C) 2005-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/16251 title Mac OS X Multiple Vulnerabilities (Security Update 2005-001) NASL family Fedora Local Security Checks NASL id FEDORA_2004-568.NASL description - Tue Dec 21 2004 Joe Orton <jorton at redhat.com> 4.3.10-3.2 - fix umask patch (#143286) - Wed Dec 15 2004 Joe Orton <jorton at redhat.com> 4.3.10-3.1 - update to 4.3.10, including security fixes (#141135) : - unserializer integer overflows, CVE-2004-1019 - exif image parsing overflow, CVE-2004-1065 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 16031 published 2004-12-23 reporter This script is Copyright (C) 2004-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/16031 title Fedora Core 3 : php-4.3.10-3.2 (2004-568) NASL family CGI abuses NASL id PHP45_MULTIPLE_FLAWS.NASL description According to its banner, the version of PHP installed on the remote host is prior to 4.3.10 / 5.0.3. It is, therefore, affected by multiple security issues that could, under certain circumstances, allow an attacker to execute arbitrary code on the remote host, provided that the attacker can pass arbitrary data to some functions, or to bypass safe_mode. last seen 2020-06-01 modified 2020-06-02 plugin id 15973 published 2004-12-15 reporter This script is Copyright (C) 2004-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/15973 title PHP < 4.3.10 / 5.0.3 Multiple Vulnerabilities NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-40-1.NASL description Stefan Esser reported several buffer overflows in PHP last seen 2020-06-01 modified 2020-06-02 plugin id 20657 published 2006-01-15 reporter Ubuntu Security Notice (C) 2004-2019 Canonical, Inc. / NASL script (C) 2006-2016 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/20657 title Ubuntu 4.10 : php4 vulnerabilities (USN-40-1) NASL family Fedora Local Security Checks NASL id FEDORA_2004-567.NASL description This update includes the latest release of PHP 4.3, including fixes for security issues in the unserializer (CVE-2004-1019), exif image parsing (CVE-2004-1065), and form upload parsing (CVE-2004-0958 and CVE-2004-0959). Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 16030 published 2004-12-23 reporter This script is Copyright (C) 2004-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/16030 title Fedora Core 2 : php-4.3.10-2.4 (2004-567) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2004-687.NASL description Updated php packages that fix various security issues and bugs are now available for Red Hat Enterprise Linux 3. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server. Flaws including possible information disclosure, double free, and negative reference index array underflow were found in the deserialization code of PHP. PHP applications may use the unserialize function on untrusted user data, which could allow a remote attacker to gain access to memory or potentially execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1019 to this issue. A flaw in the exif extension of PHP was found which lead to a stack overflow. An attacker could create a carefully crafted image file in such a way that if parsed by a PHP script using the exif extension it could cause a crash or potentially execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1065 to this issue. An information disclosure bug was discovered in the parsing of last seen 2020-06-01 modified 2020-06-02 plugin id 16041 published 2004-12-23 reporter This script is Copyright (C) 2004-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/16041 title RHEL 3 : php (RHSA-2004:687) NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-200412-14.NASL description The remote host is affected by the vulnerability described in GLSA-200412-14 (PHP: Multiple vulnerabilities) Stefan Esser and Marcus Boerger reported several different issues in the unserialize() function, including serious exploitable bugs in the way it handles negative references (CAN-2004-1019). Stefan Esser also discovered that the pack() and unpack() functions are subject to integer overflows that can lead to a heap buffer overflow and a heap information leak. Finally, he found that the way multithreaded PHP handles safe_mode_exec_dir restrictions can be bypassed, and that various path truncation issues also allow to bypass path and safe_mode restrictions. Ilia Alshanetsky found a stack overflow issue in the exif_read_data() function (CAN-2004-1065). Finally, Daniel Fabian found that addslashes and magic_quotes_gpc do not properly escape null characters and that magic_quotes_gpc contains a bug that could lead to one level directory traversal. Impact : These issues could be exploited by a remote attacker to retrieve web server heap information, bypass safe_mode or path restrictions and potentially execute arbitrary code with the rights of the web server running a PHP application. Workaround : There is no known workaround at this time. last seen 2020-06-01 modified 2020-06-02 plugin id 16001 published 2004-12-19 reporter This script is Copyright (C) 2004-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/16001 title GLSA-200412-14 : PHP: Multiple vulnerabilities NASL family Mandriva Local Security Checks NASL id MANDRAKE_MDKSA-2004-151.NASL description A number of vulnerabilities in PHP versions prior to 4.3.10 were discovered by Stefan Esser. Some of these vulnerabilities were not deemed to be severe enough to warrant CVE names, however the packages provided, with the exception of the Corporate Server 2.1 packages, include fixes for all of the vulnerabilities, thanks to the efforts of the OpenPKG team who extracted and backported the fixes. The vulnerabilities fixed in all provided packages include a fix for a possible information disclosure, double free, and negative reference index array underflow in deserialization code (CVE-2004-1019). As well, the exif_read_data() function suffers from an overflow on a long sectionname; this vulnerability was discovered by Ilia Alshanetsky (CVE-2004-1065). The other fixes that appear in Mandrakelinux 9.2 and newer packages include a fix for out of bounds memory write access in shmop_write() and integer overflow/underflows in the pack() and unpack() functions. The addslashes() function did not properly escape last seen 2020-06-01 modified 2020-06-02 plugin id 15998 published 2004-12-19 reporter This script is Copyright (C) 2004-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/15998 title Mandrake Linux Security Advisory : php (MDKSA-2004:151) NASL family SuSE Local Security Checks NASL id SUSE_SA_2005_002.NASL description The remote host is missing the patch for the advisory SUSE-SA:2005:002 (php4, mod_php4). PHP is a well known, widely-used scripting language often used within web server setups. Stefan Esser and Marcus Boerger found several buffer overflow problems in the unserializer functions of PHP (CVE-2004-1019) and Ilia Alshanetsky (CVE-2004-1065) found one in the exif parser. Any of them could allow remote attackers to execute arbitrary code as the user running the PHP interpreter. Additionally a bug where the server would disclose php sourcecode under some circumstances has been fixed. last seen 2020-06-01 modified 2020-06-02 plugin id 16306 published 2005-02-03 reporter This script is Copyright (C) 2005-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/16306 title SUSE-SA:2005:002: php4, mod_php4
Oval
| accepted | 2013-04-29T04:09:34.874-04:00 | ||||||||||||||||||||
| class | vulnerability | ||||||||||||||||||||
| contributors |
| ||||||||||||||||||||
| definition_extensions |
| ||||||||||||||||||||
| description | Buffer overflow in the exif_read_data function in PHP before 4.3.10 and PHP 5.x up to 5.0.2 allows remote attackers to execute arbitrary code via a long section name in an image file. | ||||||||||||||||||||
| family | unix | ||||||||||||||||||||
| id | oval:org.mitre.oval:def:10877 | ||||||||||||||||||||
| status | accepted | ||||||||||||||||||||
| submitted | 2010-07-09T03:56:16-04:00 | ||||||||||||||||||||
| title | Buffer overflow in the exif_read_data function in PHP before 4.3.10 and PHP 5.x up to 5.0.2 allows remote attackers to execute arbitrary code via a long section name in an image file. | ||||||||||||||||||||
| version | 26 |
Redhat
| advisories |
| ||||||||
| rpms |
|
References
- http://msgs.securepoint.com/cgi-bin/get/bugtraq0412/157.html
- http://www.mandriva.com/security/advisories?name=MDKSA-2004:151
- http://www.novell.com/linux/security/advisories/2005_02_php4_mod_php4.html
- http://www.php.net/release_4_3_10.php
- http://www.redhat.com/support/errata/RHSA-2004-687.html
- http://www.redhat.com/support/errata/RHSA-2005-032.html
- http://www.securityfocus.com/advisories/9028
- https://bugzilla.fedora.us/show_bug.cgi?id=2344
- https://exchange.xforce.ibmcloud.com/vulnerabilities/18517
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10877