Vulnerabilities > CVE-2007-1396 - Unspecified vulnerability in PHP

#%NASL_MIN_LEVEL 80502

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from openSUSE Security Update php5-3745.
#
# The text description of this plugin is (C) SUSE LLC.
#

include("compat.inc");

if (description)
{
  script_id(27391);
  script_version ("1.14");
  script_cvs_date("Date: 2019/10/25 13:36:30");

  script_cve_id("CVE-2007-0906", "CVE-2007-1285", "CVE-2007-1396", "CVE-2007-1864", "CVE-2007-2509", "CVE-2007-2510", "CVE-2007-2511", "CVE-2007-2756", "CVE-2007-2872", "CVE-2007-3007");

  script_name(english:"openSUSE 10 Security Update : php5 (php5-3745)");
  script_summary(english:"Check for the php5-3745 patch");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote openSUSE host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"The following issues have been fixed in PHP, which were spotted by the
MOPB project or fixed in PHP 5.2.3 release :

  - missing open_basedir and safe_mode restriction
    (CVE-2007-3007)

  - chunk_split() integer overflow (CVE-2007-2872)

  - DoS condition in libgd's image processing
    (CVE-2007-2756)

  - possible super-global overwrite inside
    import_request_variables() (CVE-2007-1396)

  - buffer overflow inside user_filter_factory_create()
    (CVE-2007-2511)

  - remotely trigger-able buffer overflow inside bundled
    libxmlrpc (CVE-2007-1864)

  - CRLF injection inside ftp_putcmd() (CVE-2007-2509)

  - remotely trigger-able buffer overflow inside
    make_http_soap_request() (CVE-2007-2510)

  - MOPB-41-2007:PHP 5 sqlite_udf_decode_binary() Buffer
    Overflow Vulnerability (CVE-2007-0906)

  - MOPB-03-2007: deep recursion DoS (CVE-2007-1285)"
  );
  script_set_attribute(attribute:"solution", value:"Update the affected php5 packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_cwe_id(20, 119, 189, 264);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:apache2-mod_php5");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-bcmath");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-bz2");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-calendar");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-ctype");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-curl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-dba");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-dbase");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-dom");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-exif");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-fastcgi");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-ftp");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-gd");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-gettext");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-gmp");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-iconv");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-imap");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-ldap");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-mbstring");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-mcrypt");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-mhash");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-mysql");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-ncurses");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-odbc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-openssl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-pcntl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-pdo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-pear");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-pgsql");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-posix");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-pspell");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-shmop");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-snmp");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-soap");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-sockets");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-sqlite");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-sysvmsg");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-sysvsem");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-sysvshm");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-tidy");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-tokenizer");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-wddx");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-xmlreader");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-xmlrpc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-xsl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-zlib");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:10.2");

  script_set_attribute(attribute:"patch_publication_date", value:"2007/06/16");
  script_set_attribute(attribute:"plugin_publication_date", value:"2007/10/17");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2007-2019 Tenable Network Security, Inc.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
if (release !~ "^(SUSE10\.2)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "10.2", release);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

ourarch = get_kb_item("Host/cpu");
if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);

flag = 0;

if ( rpm_check(release:"SUSE10.2", reference:"apache2-mod_php5-5.2.0-16") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-5.2.0-16") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-bcmath-5.2.0-16") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-bz2-5.2.0-16") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-calendar-5.2.0-16") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-ctype-5.2.0-16") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-curl-5.2.0-16") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-dba-5.2.0-16") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-dbase-5.2.0-16") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-devel-5.2.0-16") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-dom-5.2.0-16") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-exif-5.2.0-16") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-fastcgi-5.2.0-16") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-ftp-5.2.0-16") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-gd-5.2.0-16") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-gettext-5.2.0-16") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-gmp-5.2.0-16") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-iconv-5.2.0-16") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-imap-5.2.0-16") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-ldap-5.2.0-16") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-mbstring-5.2.0-16") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-mcrypt-5.2.0-16") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-mhash-5.2.0-16") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-mysql-5.2.0-16") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-ncurses-5.2.0-16") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-odbc-5.2.0-16") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-openssl-5.2.0-16") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-pcntl-5.2.0-16") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-pdo-5.2.0-16") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-pear-5.2.0-16") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-pgsql-5.2.0-16") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-posix-5.2.0-16") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-pspell-5.2.0-16") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-shmop-5.2.0-16") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-snmp-5.2.0-16") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-soap-5.2.0-16") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-sockets-5.2.0-16") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-sqlite-5.2.0-16") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-sysvmsg-5.2.0-16") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-sysvsem-5.2.0-16") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-sysvshm-5.2.0-16") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-tidy-5.2.0-16") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-tokenizer-5.2.0-16") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-wddx-5.2.0-16") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-xmlreader-5.2.0-16") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-xmlrpc-5.2.0-16") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-xsl-5.2.0-16") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"php5-zlib-5.2.0-16") ) flag++;

if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
  else security_hole(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "php5");
}

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The text description of this plugin is (C) Novell, Inc.
#

if (NASL_LEVEL < 3000) exit(0);

include("compat.inc");

if (description)
{
  script_id(29552);
  script_version ("1.15");
  script_cvs_date("Date: 2019/10/25 13:36:30");

  script_cve_id("CVE-2007-0906", "CVE-2007-1285", "CVE-2007-1396", "CVE-2007-1864", "CVE-2007-2509", "CVE-2007-2510", "CVE-2007-2511", "CVE-2007-2756", "CVE-2007-2872", "CVE-2007-3007");

  script_name(english:"SuSE 10 Security Update : PHP5 (ZYPP Patch Number 3754)");
  script_summary(english:"Checks rpm output for the updated packages");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote SuSE 10 host is missing a security-related patch."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"The following issues have been fixed :

  - missing open_basedir and safe_mode restriction.
    (CVE-2007-3007)

  - chunk_split() integer overflow. (CVE-2007-2872)

  - DoS condition in libgd's image processing.
    (CVE-2007-2756)

  - possible super-global overwrite inside
    import_request_variables(). (CVE-2007-1396)

  - buffer overflow inside user_filter_factory_create().
    (CVE-2007-2511)

  - remotely trigger-able buffer overflow inside bundled
    libxmlrpc. (CVE-2007-1864)

  - CRLF injection inside ftp_putcmd(). (CVE-2007-2509)

  - remotely trigger-able buffer overflow inside
    make_http_soap_request(). (CVE-2007-2510)

  - MOPB-41-2007:PHP 5 sqlite_udf_decode_binary() Buffer
    Overflow Vulnerability. (CVE-2007-0906)

  - MOPB-03-2007: deep recursion DoS (CVE-2007-1285)"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2007-0906.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2007-1285.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2007-1396.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2007-1864.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2007-2509.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2007-2510.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2007-2511.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2007-2756.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2007-2872.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2007-3007.html"
  );
  script_set_attribute(attribute:"solution", value:"Apply ZYPP patch number 3754.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_cwe_id(20, 119, 189, 264);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:suse:suse_linux");

  script_set_attribute(attribute:"patch_publication_date", value:"2007/06/22");
  script_set_attribute(attribute:"plugin_publication_date", value:"2007/12/13");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2007-2019 Tenable Network Security, Inc.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");

  exit(0);
}


include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) exit(0, "Local checks are not enabled.");
if (!get_kb_item("Host/SuSE/release")) exit(0, "The host is not running SuSE.");
if (!get_kb_item("Host/SuSE/rpm-list")) exit(1, "Could not obtain the list of installed packages.");

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) exit(1, "Failed to determine the architecture type.");
if (cpu >!< "x86_64" && cpu !~ "^i[3-6]86$") exit(1, "Local checks for SuSE 10 on the '"+cpu+"' architecture have not been implemented.");


flag = 0;
if (rpm_check(release:"SLES10", sp:1, reference:"apache2-mod_php5-5.1.2-29.40")) flag++;
if (rpm_check(release:"SLES10", sp:1, reference:"php5-5.1.2-29.40")) flag++;
if (rpm_check(release:"SLES10", sp:1, reference:"php5-bcmath-5.1.2-29.40")) flag++;
if (rpm_check(release:"SLES10", sp:1, reference:"php5-bz2-5.1.2-29.40")) flag++;
if (rpm_check(release:"SLES10", sp:1, reference:"php5-calendar-5.1.2-29.40")) flag++;
if (rpm_check(release:"SLES10", sp:1, reference:"php5-ctype-5.1.2-29.40")) flag++;
if (rpm_check(release:"SLES10", sp:1, reference:"php5-curl-5.1.2-29.40")) flag++;
if (rpm_check(release:"SLES10", sp:1, reference:"php5-dba-5.1.2-29.40")) flag++;
if (rpm_check(release:"SLES10", sp:1, reference:"php5-dbase-5.1.2-29.40")) flag++;
if (rpm_check(release:"SLES10", sp:1, reference:"php5-devel-5.1.2-29.40")) flag++;
if (rpm_check(release:"SLES10", sp:1, reference:"php5-dom-5.1.2-29.40")) flag++;
if (rpm_check(release:"SLES10", sp:1, reference:"php5-exif-5.1.2-29.40")) flag++;
if (rpm_check(release:"SLES10", sp:1, reference:"php5-fastcgi-5.1.2-29.40")) flag++;
if (rpm_check(release:"SLES10", sp:1, reference:"php5-filepro-5.1.2-29.40")) flag++;
if (rpm_check(release:"SLES10", sp:1, reference:"php5-ftp-5.1.2-29.40")) flag++;
if (rpm_check(release:"SLES10", sp:1, reference:"php5-gd-5.1.2-29.40")) flag++;
if (rpm_check(release:"SLES10", sp:1, reference:"php5-gettext-5.1.2-29.40")) flag++;
if (rpm_check(release:"SLES10", sp:1, reference:"php5-gmp-5.1.2-29.40")) flag++;
if (rpm_check(release:"SLES10", sp:1, reference:"php5-iconv-5.1.2-29.40")) flag++;
if (rpm_check(release:"SLES10", sp:1, reference:"php5-imap-5.1.2-29.40")) flag++;
if (rpm_check(release:"SLES10", sp:1, reference:"php5-ldap-5.1.2-29.40")) flag++;
if (rpm_check(release:"SLES10", sp:1, reference:"php5-mbstring-5.1.2-29.40")) flag++;
if (rpm_check(release:"SLES10", sp:1, reference:"php5-mcrypt-5.1.2-29.40")) flag++;
if (rpm_check(release:"SLES10", sp:1, reference:"php5-mhash-5.1.2-29.40")) flag++;
if (rpm_check(release:"SLES10", sp:1, reference:"php5-mysql-5.1.2-29.40")) flag++;
if (rpm_check(release:"SLES10", sp:1, reference:"php5-mysqli-5.1.2-29.40")) flag++;
if (rpm_check(release:"SLES10", sp:1, reference:"php5-ncurses-5.1.2-29.40")) flag++;
if (rpm_check(release:"SLES10", sp:1, reference:"php5-odbc-5.1.2-29.40")) flag++;
if (rpm_check(release:"SLES10", sp:1, reference:"php5-openssl-5.1.2-29.40")) flag++;
if (rpm_check(release:"SLES10", sp:1, reference:"php5-pcntl-5.1.2-29.40")) flag++;
if (rpm_check(release:"SLES10", sp:1, reference:"php5-pdo-5.1.2-29.40")) flag++;
if (rpm_check(release:"SLES10", sp:1, reference:"php5-pear-5.1.2-29.40")) flag++;
if (rpm_check(release:"SLES10", sp:1, reference:"php5-pgsql-5.1.2-29.40")) flag++;
if (rpm_check(release:"SLES10", sp:1, reference:"php5-posix-5.1.2-29.40")) flag++;
if (rpm_check(release:"SLES10", sp:1, reference:"php5-pspell-5.1.2-29.40")) flag++;
if (rpm_check(release:"SLES10", sp:1, reference:"php5-shmop-5.1.2-29.40")) flag++;
if (rpm_check(release:"SLES10", sp:1, reference:"php5-snmp-5.1.2-29.40")) flag++;
if (rpm_check(release:"SLES10", sp:1, reference:"php5-soap-5.1.2-29.40")) flag++;
if (rpm_check(release:"SLES10", sp:1, reference:"php5-sockets-5.1.2-29.40")) flag++;
if (rpm_check(release:"SLES10", sp:1, reference:"php5-sqlite-5.1.2-29.40")) flag++;
if (rpm_check(release:"SLES10", sp:1, reference:"php5-suhosin-5.1.2-29.40")) flag++;
if (rpm_check(release:"SLES10", sp:1, reference:"php5-sysvmsg-5.1.2-29.40")) flag++;
if (rpm_check(release:"SLES10", sp:1, reference:"php5-sysvsem-5.1.2-29.40")) flag++;
if (rpm_check(release:"SLES10", sp:1, reference:"php5-sysvshm-5.1.2-29.40")) flag++;
if (rpm_check(release:"SLES10", sp:1, reference:"php5-tokenizer-5.1.2-29.40")) flag++;
if (rpm_check(release:"SLES10", sp:1, reference:"php5-wddx-5.1.2-29.40")) flag++;
if (rpm_check(release:"SLES10", sp:1, reference:"php5-xmlreader-5.1.2-29.40")) flag++;
if (rpm_check(release:"SLES10", sp:1, reference:"php5-xmlrpc-5.1.2-29.40")) flag++;
if (rpm_check(release:"SLES10", sp:1, reference:"php5-xsl-5.1.2-29.40")) flag++;
if (rpm_check(release:"SLES10", sp:1, reference:"php5-zlib-5.1.2-29.40")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
  else security_hole(0);
  exit(0);
}
else exit(0, "The host is not affected.");

#
# Copyright (C) Westpoint Limited
#
# Based on scripts written by Tenable Network Security.
#
# Changes made by Tenable:
# -Add audit.inc include and adjust get_kb_item code to obtain
# PHP version and source after updates to php_version.nasl (9/5/2013)
#


include("compat.inc");

if(description)
{
  script_id(25159);
  script_version("1.37");
  script_cvs_date("Date: 2018/07/24 18:56:10");

  script_cve_id(
    "CVE-2007-0455",
    "CVE-2007-0911",
    "CVE-2007-1001",
    "CVE-2007-1521",
    "CVE-2007-1285",
    "CVE-2007-1375",
    "CVE-2007-1396",
    "CVE-2007-1399",
    "CVE-2007-1460",
    "CVE-2007-1461",
    "CVE-2007-1484",
    "CVE-2007-1522",
    "CVE-2007-1582",
    "CVE-2007-1583",
    "CVE-2007-1709",
    "CVE-2007-1710",
    "CVE-2007-1717",
    "CVE-2007-1718",
    "CVE-2007-1864",
    "CVE-2007-1883",
    "CVE-2007-2509",
    "CVE-2007-2510",
    "CVE-2007-2511",
    "CVE-2007-2727",
    "CVE-2007-2748",
    "CVE-2007-3998",
    "CVE-2007-4670"
  );
  script_bugtraq_id(
    22289,
    22764,
    22990,
    23357,
    23813,
    23818,
    23984,
    24012
  );

  script_name(english:"PHP < 4.4.7 / 5.2.2 Multiple Vulnerabilities");
  script_summary(english:"Checks version of PHP");

  script_set_attribute(attribute:"synopsis", value:
"The remote web server uses a version of PHP that is affected by
multiple flaws.");
  script_set_attribute(attribute:"description", value:
"According to its banner, the version of PHP installed on the remote
host is older than 4.4.7 / 5.2.2.  Such versions may be affected by
several issues, including buffer overflows in the GD library.");
  script_set_attribute(attribute:"see_also", value:"http://www.php.net/releases/4_4_7.php");
  script_set_attribute(attribute:"see_also", value:"http://www.php.net/releases/5_2_2.php");
  script_set_attribute(attribute:"solution", value:
"Upgrade to PHP 4.4.7 / 5.2.2 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No exploit is required");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(20, 119);

  script_set_attribute(attribute:"plugin_publication_date", value:"2007/05/04");
  script_set_attribute(attribute:"vuln_publication_date", value:"2007/01/29");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:php:php");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2007-2018 Westpoint Limited.");

  script_dependencies("php_version.nasl");
  script_require_ports("Services/www", 80);
  script_require_keys("www/PHP", "Settings/ParanoidReport");
  exit(0);
}

#
# The script code starts here
#

include("global_settings.inc");
include("misc_func.inc");
include("http.inc");
include("audit.inc");

# Banner checks of PHP are prone to false-positives so we only run the
# check if the reporting is paranoid.
if (report_paranoia <= 1) audit(AUDIT_PARANOID);

port = get_http_port(default:80, php:TRUE);

version = get_kb_item_or_exit('www/php/'+port+'/version');
match = eregmatch(string:version, pattern:'(.+) under (.+)$');
if (!isnull(match))
{
  version = match[1];
  source = match[2];
}

backported = get_kb_item('www/php/'+port+'/'+version+'/backported');
if (report_paranoia < 2 && backported)
  audit(AUDIT_BACKPORT_SERVICE, port, "PHP "+version+" install");

if (version =~ "^3\.|4\.[0-3]\." ||
    version =~ "^4\.4\.[0-6]($|[^0-9])" ||
    version =~ "^5\.[01]\." ||
    version =~ "^5\.2\.[01]($|[^0-9])"
)
{
  if (report_verbosity > 0)
  {
    report =
      '\n  Version source     : '+source +
      '\n  Installed version  : '+version+
      '\n  Fixed version      : 4.4.7 / 5.2.2\n';
    security_hole(port:port, extra:report);
  }
  else security_hole(port);
  exit(0);
}
else audit(AUDIT_LISTEN_NOT_VULN, "PHP", port, version);

#%NASL_MIN_LEVEL 80502

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from openSUSE Security Update php5-3753.
#
# The text description of this plugin is (C) SUSE LLC.
#

include("compat.inc");

if (description)
{
  script_id(27392);
  script_version ("1.14");
  script_cvs_date("Date: 2019/10/25 13:36:30");

  script_cve_id("CVE-2007-0906", "CVE-2007-1285", "CVE-2007-1396", "CVE-2007-1864", "CVE-2007-2509", "CVE-2007-2510", "CVE-2007-2511", "CVE-2007-2756", "CVE-2007-2872", "CVE-2007-3007");

  script_name(english:"openSUSE 10 Security Update : php5 (php5-3753)");
  script_summary(english:"Check for the php5-3753 patch");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote openSUSE host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"The following issues have been fixed in PHP, which were spotted by the
MOPB project or fixed in PHP 5.2.3 release :

  - missing open_basedir and safe_mode restriction
    (CVE-2007-3007)

  - chunk_split() integer overflow (CVE-2007-2872)

  - DoS condition in libgd's image processing
    (CVE-2007-2756)

  - possible super-global overwrite inside
    import_request_variables() (CVE-2007-1396)

  - buffer overflow inside user_filter_factory_create()
    (CVE-2007-2511)

  - remotely trigger-able buffer overflow inside bundled
    libxmlrpc (CVE-2007-1864)

  - CRLF injection inside ftp_putcmd() (CVE-2007-2509)

  - remotely trigger-able buffer overflow inside
    make_http_soap_request() (CVE-2007-2510)

  - MOPB-41-2007:PHP 5 sqlite_udf_decode_binary() Buffer
    Overflow Vulnerability (CVE-2007-0906)

  - MOPB-03-2007: deep recursion DoS (CVE-2007-1285)"
  );
  script_set_attribute(attribute:"solution", value:"Update the affected php5 packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_cwe_id(20, 119, 189, 264);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:apache2-mod_php5");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-bcmath");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-bz2");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-calendar");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-ctype");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-curl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-dba");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-dbase");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-dom");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-exif");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-fastcgi");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-filepro");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-ftp");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-gd");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-gettext");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-gmp");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-iconv");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-imap");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-ldap");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-mbstring");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-mcrypt");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-mhash");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-mysql");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-mysqli");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-ncurses");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-odbc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-openssl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-pcntl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-pdo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-pear");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-pgsql");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-posix");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-pspell");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-shmop");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-snmp");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-soap");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-sockets");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-sqlite");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-sysvmsg");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-sysvsem");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-sysvshm");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-tidy");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-tokenizer");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-wddx");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-xmlreader");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-xmlrpc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-xsl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-zlib");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:10.1");

  script_set_attribute(attribute:"patch_publication_date", value:"2007/06/21");
  script_set_attribute(attribute:"plugin_publication_date", value:"2007/10/17");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2007-2019 Tenable Network Security, Inc.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
if (release !~ "^(SUSE10\.1)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "10.1", release);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

ourarch = get_kb_item("Host/cpu");
if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);

flag = 0;

if ( rpm_check(release:"SUSE10.1", reference:"apache2-mod_php5-5.1.2-29.40") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-5.1.2-29.40") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-bcmath-5.1.2-29.40") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-bz2-5.1.2-29.40") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-calendar-5.1.2-29.40") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-ctype-5.1.2-29.40") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-curl-5.1.2-29.40") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-dba-5.1.2-29.40") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-dbase-5.1.2-29.40") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-devel-5.1.2-29.40") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-dom-5.1.2-29.40") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-exif-5.1.2-29.40") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-fastcgi-5.1.2-29.40") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-filepro-5.1.2-29.40") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-ftp-5.1.2-29.40") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-gd-5.1.2-29.40") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-gettext-5.1.2-29.40") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-gmp-5.1.2-29.40") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-iconv-5.1.2-29.40") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-imap-5.1.2-29.40") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-ldap-5.1.2-29.40") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-mbstring-5.1.2-29.40") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-mcrypt-5.1.2-29.40") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-mhash-5.1.2-29.40") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-mysql-5.1.2-29.40") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-mysqli-5.1.2-29.40") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-ncurses-5.1.2-29.40") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-odbc-5.1.2-29.40") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-openssl-5.1.2-29.40") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-pcntl-5.1.2-29.40") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-pdo-5.1.2-29.40") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-pear-5.1.2-29.40") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-pgsql-5.1.2-29.40") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-posix-5.1.2-29.40") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-pspell-5.1.2-29.40") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-shmop-5.1.2-29.40") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-snmp-5.1.2-29.40") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-soap-5.1.2-29.40") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-sockets-5.1.2-29.40") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-sqlite-5.1.2-29.40") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-sysvmsg-5.1.2-29.40") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-sysvsem-5.1.2-29.40") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-sysvshm-5.1.2-29.40") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-tidy-5.1.2-29.40") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-tokenizer-5.1.2-29.40") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-wddx-5.1.2-29.40") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-xmlreader-5.1.2-29.40") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-xmlrpc-5.1.2-29.40") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-xsl-5.1.2-29.40") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"php5-zlib-5.1.2-29.40") ) flag++;

if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
  else security_hole(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "php5");
}