Vulnerabilities > CVE-2006-7227 - Numeric Errors vulnerability in Pcre
Attack vector
UNKNOWN Attack complexity
UNKNOWN Privileges required
UNKNOWN Confidentiality impact
UNKNOWN Integrity impact
UNKNOWN Availability impact
UNKNOWN Summary
Integer overflow in Perl-Compatible Regular Expression (PCRE) library before 6.7 allows context-dependent attackers to execute arbitrary code via a regular expression containing a large number of named subpatterns (name_count) or long subpattern names (max_name_size), which triggers a buffer overflow. NOTE: this issue was originally subsumed by CVE-2006-7224, but that CVE has been REJECTED and split.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Nessus
NASL family SuSE Local Security Checks NASL id SUSE9_12000.NASL description Apache2 contains a copy of the pcre library. Specially crafted regular expressions could lead to a buffer overflow in the pcre library. Applications using pcre to process regular expressions from untrusted sources could therefore potentially be exploited by attackers to execute arbitrary code. (CVE-2006-7224, CVE-2007-1660) last seen 2020-06-01 modified 2020-06-02 plugin id 41170 published 2009-09-24 reporter This script is Copyright (C) 2009-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/41170 title SuSE9 Security Update : Apache 2 (YOU Patch Number 12000) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The text description of this plugin is (C) Novell, Inc. # include("compat.inc"); if (description) { script_id(41170); script_version("1.11"); script_cvs_date("Date: 2019/10/25 13:36:29"); script_cve_id("CVE-2005-4872", "CVE-2006-7227", "CVE-2006-7228", "CVE-2007-1660"); script_name(english:"SuSE9 Security Update : Apache 2 (YOU Patch Number 12000)"); script_summary(english:"Checks rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value:"The remote SuSE 9 host is missing a security-related patch." ); script_set_attribute( attribute:"description", value: "Apache2 contains a copy of the pcre library. Specially crafted regular expressions could lead to a buffer overflow in the pcre library. Applications using pcre to process regular expressions from untrusted sources could therefore potentially be exploited by attackers to execute arbitrary code. (CVE-2006-7224, CVE-2007-1660)" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2006-7224.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2007-1660.html" ); script_set_attribute(attribute:"solution", value:"Apply YOU patch number 12000."); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P"); script_cwe_id(119, 189); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/o:suse:suse_linux"); script_set_attribute(attribute:"patch_publication_date", value:"2007/12/06"); script_set_attribute(attribute:"plugin_publication_date", value:"2009/09/24"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2009-2019 Tenable Network Security, Inc."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list"); exit(0); } include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) exit(0, "Local checks are not enabled."); if (!get_kb_item("Host/SuSE/release")) exit(0, "The host is not running SuSE."); if (!get_kb_item("Host/SuSE/rpm-list")) exit(1, "Could not obtain the list of installed packages."); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) exit(1, "Failed to determine the architecture type."); if (cpu >!< "x86_64" && cpu !~ "^i[3-6]86$") exit(1, "Local checks for SuSE 9 on the '"+cpu+"' architecture have not been implemented."); flag = 0; if (rpm_check(release:"SUSE9", reference:"apache2-2.0.59-1.6")) flag++; if (rpm_check(release:"SUSE9", reference:"apache2-devel-2.0.59-1.6")) flag++; if (rpm_check(release:"SUSE9", reference:"apache2-doc-2.0.59-1.6")) flag++; if (rpm_check(release:"SUSE9", reference:"apache2-example-pages-2.0.59-1.6")) flag++; if (rpm_check(release:"SUSE9", reference:"apache2-prefork-2.0.59-1.6")) flag++; if (rpm_check(release:"SUSE9", reference:"apache2-worker-2.0.59-1.6")) flag++; if (rpm_check(release:"SUSE9", reference:"libapr0-2.0.59-1.6")) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get()); else security_warning(0); exit(0); } else exit(0, "The host is not affected.");
NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2007-1052.NASL description From Red Hat Security Advisory 2007:1052 : Updated pcre packages that correct security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. [Updated 15 November 2007] Further analysis of these flaws in PCRE has led to the single CVE identifier CVE-2006-7224 being split into three separate identifiers and a re-analysis of the risk of each of the flaws. We are therefore updating the text of this advisory to use the correct CVE names for the two flaws fixed by these erratum packages, and downgrading the security impact of this advisory from critical to important. No changes have been made to the packages themselves. PCRE is a Perl-compatible regular expression library. Flaws were found in the way PCRE handles certain malformed regular expressions. If an application linked against PCRE, such as Konqueror, parses a malicious regular expression, it may be possible to run arbitrary code as the user running the application. (CVE-2005-4872, CVE-2006-7227) Users of PCRE are advised to upgrade to these updated packages, which contain a backported patch to correct these issues. last seen 2020-06-01 modified 2020-06-02 plugin id 67610 published 2013-07-12 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/67610 title Oracle Linux 4 : pcre (ELSA-2007-1052) NASL family SuSE Local Security Checks NASL id SUSE_APACHE2-MOD_PHP5-4810.NASL description This update fixes multiple bugs in php : - use system pcre library to fix several pcre vulnerabilities (CVE-2007-1659, CVE-2006-7230, CVE-2007-1660, CVE-2006-7227 CVE-2005-4872, CVE-2006-7228) - Flaws in processing multi byte sequences in htmlentities/htmlspecialchars (CVE-2007-5898) - overly long arguments to the dl() function could crash php (CVE-2007-4825) - overy long arguments to the glob() function could crash php (CVE-2007-4782) - overly long arguments to some iconv functions could crash php (CVE-2007-4840) - overy long arguments to the setlocale() function could crash php (CVE-2007-4784) - the wordwrap-Function could cause a floating point exception (CVE-2007-3998) - overy long arguments to the fnmatch() function could crash php (CVE-2007-4782) - incorrect size calculation in the chunk_split function could lead to a buffer overflow (CVE-2007-4661) - Flaws in the GD extension could lead to integer overflows (CVE-2007-3996) - The money_format function contained format string flaws (CVE-2007-4658) - Data for some time zones has been updated last seen 2020-06-01 modified 2020-06-02 plugin id 29878 published 2008-01-08 reporter This script is Copyright (C) 2008-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/29878 title openSUSE 10 Security Update : apache2-mod_php5 (apache2-mod_php5-4810) NASL family SuSE Local Security Checks NASL id SUSE_APACHE2-MOD_PHP5-4808.NASL description This update fixes multiple bugs in php : - use system pcre library to fix several pcre vulnerabilities. (CVE-2007-1659 / CVE-2006-7230 / CVE-2007-1660 / CVE-2006-7227 / CVE-2005-4872 / CVE-2006-7228) - Flaws in processing multi byte sequences in htmlentities/htmlspecialchars. (CVE-2007-5898) - overly long arguments to the dl() function could crash php. (CVE-2007-4825) - overy long arguments to the glob() function could crash php. (CVE-2007-4782) - overly long arguments to some iconv functions could crash php. (CVE-2007-4840) - overy long arguments to the setlocale() function could crash php. (CVE-2007-4784) - the wordwrap-Function could cause a floating point exception. (CVE-2007-3998) - overy long arguments to the fnmatch() function could crash php. (CVE-2007-4782) - incorrect size calculation in the chunk_split function could lead to a buffer overflow. (CVE-2007-4661) - Flaws in the GD extension could lead to integer overflows. (CVE-2007-3996) - The money_format function contained format string flaws. (CVE-2007-4658) - Data for some time zones has been updated last seen 2020-06-01 modified 2020-06-02 plugin id 29780 published 2007-12-24 reporter This script is Copyright (C) 2007-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/29780 title SuSE 10 Security Update : PHP5 (ZYPP Patch Number 4808) NASL family SuSE Local Security Checks NASL id SUSE9_12049.NASL description This update fixes multiple bugs in php : - several problems in pcre (CVE-2007-1660, CVE-2006-7225, CVE-2006-7224, CVE-2006-7226 CVE-2007-1659, CVE-2006-7230) - Flaws in processing multi byte sequences in htmlentities/htmlspecialchars. (CVE-2007-5898) - overly long arguments to the dl() function could crash php. (CVE-2007-4825) - overy long arguments to the glob() function could crash php. (CVE-2007-4782) - overly long arguments to some iconv functions could crash php. (CVE-2007-4840) - overy long arguments to the setlocale() function could crash php. (CVE-2007-4784) - the wordwrap-Function could cause a floating point exception. (CVE-2007-3998) - overy long arguments to the fnmatch() function could crash php. (CVE-2007-4782) - incorrect size calculation in the chunk_split function could lead to a buffer overflow. (CVE-2007-4661, CVE-2007-2872) - Flaws in the GD extension could lead to integer overflows. (CVE-2007-3996) - The money_format function contained format string flaws. (CVE-2007-4658) last seen 2020-06-01 modified 2020-06-02 plugin id 41187 published 2009-09-24 reporter This script is Copyright (C) 2009-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/41187 title SuSE9 Security Update : PHP4 (YOU Patch Number 12049) NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-200711-30.NASL description The remote host is affected by the vulnerability described in GLSA-200711-30 (PCRE: Multiple vulnerabilities) Tavis Ormandy (Google Security) discovered multiple vulnerabilities in PCRE. He reported an error when processing last seen 2020-06-01 modified 2020-06-02 plugin id 28319 published 2007-11-26 reporter This script is Copyright (C) 2007-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/28319 title GLSA-200711-30 : PCRE: Multiple vulnerabilities NASL family Mandriva Local Security Checks NASL id MANDRAKE_MDKSA-2007-212.NASL description Multiple vulnerabilities were discovered by Tavis Ormandy and Will Drewry in the way that pcre handled certain malformed regular expressions. If an application linked against pcre, such as Konqueror, parses a malicious regular expression, it could lead to the execution of arbitrary code as the user running the application. Updated packages have been patched to prevent this issue. Additionally, Corporate Server 4.0 was updated to pcre version 6.7 which corrected CVE-2006-7225, CVE-2006-7226, CVE-2006-7227, CVE-2006-7228, and CVE-2006-7230. last seen 2020-06-01 modified 2020-06-02 plugin id 27849 published 2007-11-09 reporter This script is Copyright (C) 2007-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/27849 title Mandrake Linux Security Advisory : pcre (MDKSA-2007:212) NASL family Debian Local Security Checks NASL id DEBIAN_DSA-1570.NASL description Andrews Salomon reported that kazehakase, a GTK+-based web browser that allows pluggable rendering engines, contained an embedded copy of the PCRE library in its source tree which was compiled in and used in preference to the system-wide version of this library. The PCRE library has been updated to fix the security issues reported against it in previous Debian Security Advisories. This update ensures that kazehakase uses that supported library, and not its own embedded and insecure version. last seen 2020-06-01 modified 2020-06-02 plugin id 32144 published 2008-05-09 reporter This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/32144 title Debian DSA-1570-1 : kazehakase - various NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2007-1052.NASL description Updated pcre packages that correct security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. [Updated 15 November 2007] Further analysis of these flaws in PCRE has led to the single CVE identifier CVE-2006-7224 being split into three separate identifiers and a re-analysis of the risk of each of the flaws. We are therefore updating the text of this advisory to use the correct CVE names for the two flaws fixed by these erratum packages, and downgrading the security impact of this advisory from critical to important. No changes have been made to the packages themselves. PCRE is a Perl-compatible regular expression library. Flaws were found in the way PCRE handles certain malformed regular expressions. If an application linked against PCRE, such as Konqueror, parses a malicious regular expression, it may be possible to run arbitrary code as the user running the application. (CVE-2005-4872, CVE-2006-7227) Users of PCRE are advised to upgrade to these updated packages, which contain a backported patch to correct these issues. last seen 2020-06-01 modified 2020-06-02 plugin id 28169 published 2007-11-12 reporter This script is Copyright (C) 2007-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/28169 title RHEL 4 / 5 : pcre (RHSA-2007:1052) NASL family CentOS Local Security Checks NASL id CENTOS_RHSA-2007-1052.NASL description Updated pcre packages that correct security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. [Updated 15 November 2007] Further analysis of these flaws in PCRE has led to the single CVE identifier CVE-2006-7224 being split into three separate identifiers and a re-analysis of the risk of each of the flaws. We are therefore updating the text of this advisory to use the correct CVE names for the two flaws fixed by these erratum packages, and downgrading the security impact of this advisory from critical to important. No changes have been made to the packages themselves. PCRE is a Perl-compatible regular expression library. Flaws were found in the way PCRE handles certain malformed regular expressions. If an application linked against PCRE, such as Konqueror, parses a malicious regular expression, it may be possible to run arbitrary code as the user running the application. (CVE-2005-4872, CVE-2006-7227) Users of PCRE are advised to upgrade to these updated packages, which contain a backported patch to correct these issues. last seen 2020-06-01 modified 2020-06-02 plugin id 37163 published 2009-04-23 reporter This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/37163 title CentOS 4 : pcre (CESA-2007:1052) NASL family Scientific Linux Local Security Checks NASL id SL_20071109_PCRE_ON_SL5_X.NASL description This importance of this has been reduced to last seen 2020-06-01 modified 2020-06-02 plugin id 60298 published 2012-08-01 reporter This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/60298 title Scientific Linux Security Update : pcre on SL5.x i386/x86_64
Oval
accepted | 2013-04-29T04:05:24.773-04:00 | ||||||||||||||||||||||||
class | vulnerability | ||||||||||||||||||||||||
contributors |
| ||||||||||||||||||||||||
definition_extensions |
| ||||||||||||||||||||||||
description | Integer overflow in Perl-Compatible Regular Expression (PCRE) library before 6.7 allows context-dependent attackers to execute arbitrary code via a regular expression containing a large number of named subpatterns (name_count) or long subpattern names (max_name_size), which triggers a buffer overflow. NOTE: this issue was originally subsumed by CVE-2006-7224, but that CVE has been REJECTED and split. | ||||||||||||||||||||||||
family | unix | ||||||||||||||||||||||||
id | oval:org.mitre.oval:def:10408 | ||||||||||||||||||||||||
status | accepted | ||||||||||||||||||||||||
submitted | 2010-07-09T03:56:16-04:00 | ||||||||||||||||||||||||
title | Integer overflow in Perl-Compatible Regular Expression (PCRE) library before 6.7 allows context-dependent attackers to execute arbitrary code via a regular expression containing a large number of named subpatterns (name_count) or long subpattern names (max_name_size), which triggers a buffer overflow. NOTE: this issue was originally subsumed by CVE-2006-7224, but that CVE has been REJECTED and split. | ||||||||||||||||||||||||
version | 27 |
Redhat
advisories |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
rpms |
|
References
- http://scary.beasts.org/security/CESA-2007-006.html
- http://www.pcre.org/changelog.txt
- http://www.redhat.com/support/errata/RHSA-2007-1052.html
- http://secunia.com/advisories/27582
- http://support.avaya.com/elmodocs2/security/ASA-2007-493.htm
- http://security.gentoo.org/glsa/glsa-200711-30.xml
- http://www.novell.com/linux/security/advisories/2007_62_pcre.html
- http://www.securityfocus.com/bid/26462
- http://secunia.com/advisories/27741
- http://secunia.com/advisories/27773
- http://secunia.com/advisories/27869
- http://bugs.gentoo.org/show_bug.cgi?id=198976
- http://security.gentoo.org/glsa/glsa-200801-02.xml
- http://secunia.com/advisories/28406
- http://secunia.com/advisories/28414
- http://security.gentoo.org/glsa/glsa-200801-18.xml
- http://security.gentoo.org/glsa/glsa-200801-19.xml
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:030
- http://lists.opensuse.org/opensuse-security-announce/2008-01/msg00006.html
- http://secunia.com/advisories/28658
- http://secunia.com/advisories/28714
- http://secunia.com/advisories/28720
- http://security.gentoo.org/glsa/glsa-200805-11.xml
- http://secunia.com/advisories/30155
- http://secunia.com/advisories/30219
- http://secunia.com/advisories/30106
- http://www.debian.org/security/2008/dsa-1570
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10408