Vulnerabilities > CVE-2007-0911 - Remote Denial of Service vulnerability in PHP 5.2.1

#
# Copyright (C) Westpoint Limited
#
# Based on scripts written by Tenable Network Security.
#
# Changes made by Tenable:
# -Add audit.inc include and adjust get_kb_item code to obtain
# PHP version and source after updates to php_version.nasl (9/5/2013)
#


include("compat.inc");

if(description)
{
  script_id(25159);
  script_version("1.37");
  script_cvs_date("Date: 2018/07/24 18:56:10");

  script_cve_id(
    "CVE-2007-0455",
    "CVE-2007-0911",
    "CVE-2007-1001",
    "CVE-2007-1521",
    "CVE-2007-1285",
    "CVE-2007-1375",
    "CVE-2007-1396",
    "CVE-2007-1399",
    "CVE-2007-1460",
    "CVE-2007-1461",
    "CVE-2007-1484",
    "CVE-2007-1522",
    "CVE-2007-1582",
    "CVE-2007-1583",
    "CVE-2007-1709",
    "CVE-2007-1710",
    "CVE-2007-1717",
    "CVE-2007-1718",
    "CVE-2007-1864",
    "CVE-2007-1883",
    "CVE-2007-2509",
    "CVE-2007-2510",
    "CVE-2007-2511",
    "CVE-2007-2727",
    "CVE-2007-2748",
    "CVE-2007-3998",
    "CVE-2007-4670"
  );
  script_bugtraq_id(
    22289,
    22764,
    22990,
    23357,
    23813,
    23818,
    23984,
    24012
  );

  script_name(english:"PHP < 4.4.7 / 5.2.2 Multiple Vulnerabilities");
  script_summary(english:"Checks version of PHP");

  script_set_attribute(attribute:"synopsis", value:
"The remote web server uses a version of PHP that is affected by
multiple flaws.");
  script_set_attribute(attribute:"description", value:
"According to its banner, the version of PHP installed on the remote
host is older than 4.4.7 / 5.2.2.  Such versions may be affected by
several issues, including buffer overflows in the GD library.");
  script_set_attribute(attribute:"see_also", value:"http://www.php.net/releases/4_4_7.php");
  script_set_attribute(attribute:"see_also", value:"http://www.php.net/releases/5_2_2.php");
  script_set_attribute(attribute:"solution", value:
"Upgrade to PHP 4.4.7 / 5.2.2 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No exploit is required");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(20, 119);

  script_set_attribute(attribute:"plugin_publication_date", value:"2007/05/04");
  script_set_attribute(attribute:"vuln_publication_date", value:"2007/01/29");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:php:php");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2007-2018 Westpoint Limited.");

  script_dependencies("php_version.nasl");
  script_require_ports("Services/www", 80);
  script_require_keys("www/PHP", "Settings/ParanoidReport");
  exit(0);
}

#
# The script code starts here
#

include("global_settings.inc");
include("misc_func.inc");
include("http.inc");
include("audit.inc");

# Banner checks of PHP are prone to false-positives so we only run the
# check if the reporting is paranoid.
if (report_paranoia <= 1) audit(AUDIT_PARANOID);

port = get_http_port(default:80, php:TRUE);

version = get_kb_item_or_exit('www/php/'+port+'/version');
match = eregmatch(string:version, pattern:'(.+) under (.+)$');
if (!isnull(match))
{
  version = match[1];
  source = match[2];
}

backported = get_kb_item('www/php/'+port+'/'+version+'/backported');
if (report_paranoia < 2 && backported)
  audit(AUDIT_BACKPORT_SERVICE, port, "PHP "+version+" install");

if (version =~ "^3\.|4\.[0-3]\." ||
    version =~ "^4\.4\.[0-6]($|[^0-9])" ||
    version =~ "^5\.[01]\." ||
    version =~ "^5\.2\.[01]($|[^0-9])"
)
{
  if (report_verbosity > 0)
  {
    report =
      '\n  Version source     : '+source +
      '\n  Installed version  : '+version+
      '\n  Fixed version      : 4.4.7 / 5.2.2\n';
    security_hole(port:port, extra:report);
  }
  else security_hole(port);
  exit(0);
}
else audit(AUDIT_LISTEN_NOT_VULN, "PHP", port, version);

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The text description of this plugin is (C) Novell, Inc.
#

include("compat.inc");

if (description)
{
  script_id(29377);
  script_version ("1.13");
  script_cvs_date("Date: 2019/10/25 13:36:29");

  script_cve_id("CVE-2006-6383", "CVE-2007-0906", "CVE-2007-0907", "CVE-2007-0908", "CVE-2007-0909", "CVE-2007-0910", "CVE-2007-0911");

  script_name(english:"SuSE 10 Security Update : PHP5 (ZYPP Patch Number 2684)");
  script_summary(english:"Checks rpm output for the updated packages");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote SuSE 10 host is missing a security-related patch."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"This update fixes security problems also fixed in PHP 5.2.1, including
following problems :

  - Multiple buffer overflows in PHP before 5.2.1 allow
    attackers to cause a denial of service and possibly
    execute arbitrary code via unspecified vectors in the
    (1) session, (2) zip, (3) imap, and (4) sqlite
    extensions; (5) stream filters; and the (6) str_replace,
    (7) mail, (8) ibase_delete_user, (9) ibase_add_user, and
    (10) ibase_modify_user functions. (CVE-2007-0906)

  - Buffer underflow in PHP before 5.2.1 allows attackers to
    cause a denial of service via unspecified vectors
    involving the sapi_header_op function. (CVE-2007-0907)

  - The wddx extension in PHP before 5.2.1 allows remote
    attackers to obtain sensitive information via
    unspecified vectors. (CVE-2007-0908)

  - Multiple format string vulnerabilities in PHP before
    5.2.1 might allow attackers to execute arbitrary code
    via format string specifiers to (1) all of the *print
    functions on 64-bit systems, and (2) the odbc_result_all
    function. (CVE-2007-0909)

  - Unspecified vulnerability in PHP before 5.2.1 allows
    attackers to 'clobber' certain super-global variables
    via unspecified vectors. (CVE-2007-0910)

  - Off-by-one error in the str_ireplace function in PHP
    5.2.1 might allow context-dependent attackers to cause a
    denial of service (crash). (CVE-2007-0911)

  - PHP 5.2.0 and 4.4 allows local users to bypass safe_mode
    and open_basedir restrictions via a malicious path and a
    null byte before a ';' in a session_save_path argument,
    followed by an allowed path, which causes a parsing
    inconsistency in which PHP validates the allowed path
    but sets session.save_path to the malicious path. And
    another fix for open_basedir was added to stop mixing up
    its setting in a virtual host environment.
    (CVE-2006-6383)"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2006-6383.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2007-0906.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2007-0907.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2007-0908.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2007-0909.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2007-0910.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2007-0911.html"
  );
  script_set_attribute(attribute:"solution", value:"Apply ZYPP patch number 2684.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_cwe_id(20);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:suse:suse_linux");

  script_set_attribute(attribute:"patch_publication_date", value:"2007/03/03");
  script_set_attribute(attribute:"plugin_publication_date", value:"2007/12/13");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2007-2019 Tenable Network Security, Inc.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");

  exit(0);
}


include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) exit(0, "Local checks are not enabled.");
if (!get_kb_item("Host/SuSE/release")) exit(0, "The host is not running SuSE.");
if (!get_kb_item("Host/SuSE/rpm-list")) exit(1, "Could not obtain the list of installed packages.");

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) exit(1, "Failed to determine the architecture type.");
if (cpu >!< "x86_64" && cpu !~ "^i[3-6]86$") exit(1, "Local checks for SuSE 10 on the '"+cpu+"' architecture have not been implemented.");


flag = 0;
if (rpm_check(release:"SLES10", sp:0, reference:"apache2-mod_php5-5.1.2-29.25.3")) flag++;
if (rpm_check(release:"SLES10", sp:0, reference:"php5-5.1.2-29.25.3")) flag++;
if (rpm_check(release:"SLES10", sp:0, reference:"php5-bcmath-5.1.2-29.25.3")) flag++;
if (rpm_check(release:"SLES10", sp:0, reference:"php5-curl-5.1.2-29.25.3")) flag++;
if (rpm_check(release:"SLES10", sp:0, reference:"php5-dba-5.1.2-29.25.3")) flag++;
if (rpm_check(release:"SLES10", sp:0, reference:"php5-devel-5.1.2-29.25.3")) flag++;
if (rpm_check(release:"SLES10", sp:0, reference:"php5-dom-5.1.2-29.25.3")) flag++;
if (rpm_check(release:"SLES10", sp:0, reference:"php5-exif-5.1.2-29.25.3")) flag++;
if (rpm_check(release:"SLES10", sp:0, reference:"php5-fastcgi-5.1.2-29.25.3")) flag++;
if (rpm_check(release:"SLES10", sp:0, reference:"php5-ftp-5.1.2-29.25.3")) flag++;
if (rpm_check(release:"SLES10", sp:0, reference:"php5-gd-5.1.2-29.25.3")) flag++;
if (rpm_check(release:"SLES10", sp:0, reference:"php5-iconv-5.1.2-29.25.3")) flag++;
if (rpm_check(release:"SLES10", sp:0, reference:"php5-imap-5.1.2-29.25.3")) flag++;
if (rpm_check(release:"SLES10", sp:0, reference:"php5-ldap-5.1.2-29.25.3")) flag++;
if (rpm_check(release:"SLES10", sp:0, reference:"php5-mbstring-5.1.2-29.25.3")) flag++;
if (rpm_check(release:"SLES10", sp:0, reference:"php5-mhash-5.1.2-29.25.3")) flag++;
if (rpm_check(release:"SLES10", sp:0, reference:"php5-mysql-5.1.2-29.25.3")) flag++;
if (rpm_check(release:"SLES10", sp:0, reference:"php5-mysqli-5.1.2-29.25.3")) flag++;
if (rpm_check(release:"SLES10", sp:0, reference:"php5-odbc-5.1.2-29.25.3")) flag++;
if (rpm_check(release:"SLES10", sp:0, reference:"php5-pdo-5.1.2-29.25.3")) flag++;
if (rpm_check(release:"SLES10", sp:0, reference:"php5-pear-5.1.2-29.25.3")) flag++;
if (rpm_check(release:"SLES10", sp:0, reference:"php5-pgsql-5.1.2-29.25.3")) flag++;
if (rpm_check(release:"SLES10", sp:0, reference:"php5-soap-5.1.2-29.25.3")) flag++;
if (rpm_check(release:"SLES10", sp:0, reference:"php5-sysvmsg-5.1.2-29.25.3")) flag++;
if (rpm_check(release:"SLES10", sp:0, reference:"php5-wddx-5.1.2-29.25.3")) flag++;
if (rpm_check(release:"SLES10", sp:0, reference:"php5-xmlrpc-5.1.2-29.25.3")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
  else security_hole(0);
  exit(0);
}
else exit(0, "The host is not affected.");

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Gentoo Linux Security Advisory GLSA 200703-21.
#
# The advisory text is Copyright (C) 2001-2016 Gentoo Foundation, Inc.
# and licensed under the Creative Commons - Attribution / Share Alike 
# license. See http://creativecommons.org/licenses/by-sa/3.0/
#

include("compat.inc");

if (description)
{
  script_id(24887);
  script_version("1.19");
  script_cvs_date("Date: 2019/08/02 13:32:44");

  script_cve_id("CVE-2006-5465", "CVE-2007-0906", "CVE-2007-0907", "CVE-2007-0908", "CVE-2007-0909", "CVE-2007-0910", "CVE-2007-0911", "CVE-2007-0988", "CVE-2007-1286", "CVE-2007-1375", "CVE-2007-1376", "CVE-2007-1380", "CVE-2007-1383");
  script_bugtraq_id(20879, 22496, 22505, 22765, 22805, 22851, 22862);
  script_xref(name:"GLSA", value:"200703-21");

  script_name(english:"GLSA-200703-21 : PHP: Multiple vulnerabilities");
  script_summary(english:"Checks for updated package(s) in /var/db/pkg");

  script_set_attribute(
    attribute:"synopsis", 
    value:
"The remote Gentoo host is missing one or more security-related
patches."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"The remote host is affected by the vulnerability described in GLSA-200703-21
(PHP: Multiple vulnerabilities)

    Several vulnerabilities were found in PHP by the Hardened-PHP Project
    and other researchers. These vulnerabilities include a heap-based
    buffer overflow in htmlentities() and htmlspecialchars() if called with
    UTF-8 parameters, and an off-by-one error in str_ireplace(). Other
    vulnerabilities were also found in the PHP4 branch, including possible
    overflows, stack corruptions and a format string vulnerability in the
    *print() functions on 64 bit systems.
  
Impact :

    Remote attackers might be able to exploit these issues in PHP
    applications making use of the affected functions, potentially
    resulting in the execution of arbitrary code, Denial of Service,
    execution of scripted contents in the context of the affected site,
    security bypass or information leak.
  
Workaround :

    There is no known workaround at this time."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.php.net/releases/4_4_5.php"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.php.net/releases/5_2_1.php"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security.gentoo.org/glsa/200703-21"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"All PHP users should upgrade to the latest version:
    # emerge --sync
    # emerge --ask --oneshot --verbose 'dev-lang/php'"
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'PHP 4 unserialize() ZVAL Reference Counter Overflow (Cookie)');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
  script_cwe_id(20, 189, 399);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:php");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux");

  script_set_attribute(attribute:"patch_publication_date", value:"2007/03/20");
  script_set_attribute(attribute:"plugin_publication_date", value:"2007/03/26");
  script_set_attribute(attribute:"vuln_publication_date", value:"2006/11/02");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2007-2019 Tenable Network Security, Inc.");
  script_family(english:"Gentoo Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("qpkg.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo");
if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;

if (qpkg_check(package:"dev-lang/php", unaffected:make_list("ge 5.2.1-r3", "rge 5.1.6-r11", "rge 4.4.6", "rge 4.4.7", "rge 4.4.8_pre20070816"), vulnerable:make_list("lt 5.2.1-r3"))) flag++;

if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());
  else security_hole(0);
  exit(0);
}
else
{
  tested = qpkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "PHP");
}

#%NASL_MIN_LEVEL 80502

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from openSUSE Security Update php5-2687.
#
# The text description of this plugin is (C) SUSE LLC.
#

include("compat.inc");

if (description)
{
  script_id(27390);
  script_version ("1.13");
  script_cvs_date("Date: 2019/10/25 13:36:30");

  script_cve_id("CVE-2006-6383", "CVE-2007-0906", "CVE-2007-0907", "CVE-2007-0908", "CVE-2007-0909", "CVE-2007-0910", "CVE-2007-0911");

  script_name(english:"openSUSE 10 Security Update : php5 (php5-2687)");
  script_summary(english:"Check for the php5-2687 patch");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote openSUSE host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"CVE-2007-0906: Multiple buffer overflows in PHP before 5.2.1 allow
attackers to cause a denial of service and possibly execute arbitrary
code via unspecified vectors in the (1) session, (2) zip, (3) imap,
and (4) sqlite extensions; (5) stream filters; and the (6)
str_replace, (7) mail, (8) ibase_delete_user, (9) ibase_add_user, and
(10) ibase_modify_user functions.

CVE-2007-0907: Buffer underflow in PHP before 5.2.1 allows attackers
to cause a denial of service via unspecified vectors involving the
sapi_header_op function.

CVE-2007-0908: The wddx extension in PHP before 5.2.1 allows remote
attackers to obtain sensitive information via unspecified vectors.

CVE-2007-0909: Multiple format string vulnerabilities in PHP before
5.2.1 might allow attackers to execute arbitrary code via format
string specifiers to (1) all of the *print functions on 64-bit
systems, and (2) the odbc_result_all function.

CVE-2007-0910: Unspecified vulnerability in PHP before 5.2.1 allows
attackers to 'clobber' certain super-global variables via unspecified
vectors.

CVE-2007-0911: Off-by-one error in the str_ireplace function in PHP
5.2.1 might allow context-dependent attackers to cause a denial of
service (crash).

CVE-2006-6383: PHP 5.2.0 and 4.4 allows local users to bypass
safe_mode and open_basedir restrictions via a malicious path and a
null byte before a ';' in a session_save_path argument, followed by an
allowed path, which causes a parsing inconsistency in which PHP
validates the allowed path but sets session.save_path to the malicious
path. And another fix for open_basedir was added to stop mixing up its
setting in a virtual host environment."
  );
  script_set_attribute(attribute:"solution", value:"Update the affected php5 packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_cwe_id(20);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:apache2-mod_php5");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-bcmath");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-curl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-dba");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-dom");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-exif");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-fastcgi");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-ftp");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-gd");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-iconv");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-imap");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-ldap");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-mbstring");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-mhash");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-mysql");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-mysqli");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-odbc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-pear");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-pgsql");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-soap");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-sysvmsg");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-sysvshm");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-wddx");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-xmlrpc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-zip");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:10.1");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:10.2");

  script_set_attribute(attribute:"patch_publication_date", value:"2007/03/02");
  script_set_attribute(attribute:"plugin_publication_date", value:"2007/10/17");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2007-2019 Tenable Network Security, Inc.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
if (release !~ "^(SUSE10\.1|SUSE10\.2)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "10.1 / 10.2", release);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

ourarch = get_kb_item("Host/cpu");
if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);

flag = 0;

if ( rpm_check(release:"SUSE10.1", reference:"apache2-mod_php5-5.1.2-29.25.3") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-5.1.2-29.25.3") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-bcmath-5.1.2-29.25.3") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-curl-5.1.2-29.25.3") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-dba-5.1.2-29.25.3") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-devel-5.1.2-29.25.3") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-dom-5.1.2-29.25.3") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-exif-5.1.2-29.25.3") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-fastcgi-5.1.2-29.25.3") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-ftp-5.1.2-29.25.3") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-gd-5.1.2-29.25.3") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-iconv-5.1.2-29.25.3") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-imap-5.1.2-29.25.3") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-ldap-5.1.2-29.25.3") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-mbstring-5.1.2-29.25.3") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-mhash-5.1.2-29.25.3") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-mysql-5.1.2-29.25.3") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-mysqli-5.1.2-29.25.3") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-odbc-5.1.2-29.25.3") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-pear-5.1.2-29.25.3") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-pgsql-5.1.2-29.25.3") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-soap-5.1.2-29.25.3") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-sysvmsg-5.1.2-29.25.3") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-sysvshm-5.1.2-29.25.3") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-wddx-5.1.2-29.25.3") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-xmlrpc-5.1.2-29.25.3") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"apache2-mod_php5-5.2.0-12") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-5.2.0-12") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-bcmath-5.2.0-12") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-curl-5.2.0-12") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-dba-5.2.0-12") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-devel-5.2.0-12") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-dom-5.2.0-12") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-exif-5.2.0-12") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-fastcgi-5.2.0-12") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-ftp-5.2.0-12") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-gd-5.2.0-12") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-iconv-5.2.0-12") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-imap-5.2.0-12") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-ldap-5.2.0-12") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-mbstring-5.2.0-12") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-mhash-5.2.0-12") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-mysql-5.2.0-12") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-odbc-5.2.0-12") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-pear-5.2.0-12") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-pgsql-5.2.0-12") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-soap-5.2.0-12") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-sysvmsg-5.2.0-12") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-sysvshm-5.2.0-12") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-wddx-5.2.0-12") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-xmlrpc-5.2.0-12") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-zip-5.2.0-12") ) flag++;

if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
  else security_hole(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "apache2-mod_php5 / php5 / php5-bcmath / php5-curl / php5-dba / etc");
}