Vulnerabilities > CVE-2007-1717 - Unspecified vulnerability in PHP
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
NONE Integrity impact
PARTIAL Availability impact
NONE Summary
The mail function in PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 truncates e-mail messages at the first ASCIIZ ('\0') byte, which might allow context-dependent attackers to prevent intended information from being delivered in e-mail messages. NOTE: this issue might be security-relevant in cases when the trailing contents of e-mail messages are important, such as logging information or if the message is expected to be well-formed.
Vulnerable Configurations
Exploit-Db
description | PHP 5.2.1 Folded Mail Headers Email Header Injection Vulnerability. CVE-2007-1717,CVE-2007-1718. Remote exploit for php platform |
id | EDB-ID:29784 |
last seen | 2016-02-03 |
modified | 2007-11-26 |
published | 2007-11-26 |
reporter | Stefan Esser |
source | https://www.exploit-db.com/download/29784/ |
title | PHP <= 5.2.1 Folded Mail Headers Email Header Injection Vulnerability |
Nessus
NASL family CGI abuses NASL id PHP_5_2_2.NASL description According to its banner, the version of PHP 5.x installed on the remote host is older than 5.2.2. It is, therefore, affected by multiple vulnerabilities: - A heap-based buffer overflow vulnerability was found in PHP last seen 2020-06-01 modified 2020-06-02 plugin id 17797 published 2012-01-11 reporter This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/17797 title PHP 5.x < 5.2.2 Multiple vulnerabilities code # # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(17797); script_version("1.7"); script_cvs_date("Date: 2019/03/27 13:17:50"); script_cve_id( "CVE-2007-1001", "CVE-2007-1583", "CVE-2007-1649", "CVE-2007-1717", "CVE-2007-1718" ); script_bugtraq_id(23105, 23357); script_name(english:"PHP 5.x < 5.2.2 Multiple vulnerabilities"); script_summary(english:"Checks version of PHP"); script_set_attribute( attribute:"synopsis", value: "The remote web server uses a version of PHP that is affected by multiple vulnerabilities." ); script_set_attribute( attribute:"description", value: "According to its banner, the version of PHP 5.x installed on the remote host is older than 5.2.2. It is, therefore, affected by multiple vulnerabilities: - A heap-based buffer overflow vulnerability was found in PHP's gd extension. A script that could be forced to process WBMP images from an untrusted source could result in arbitrary code execution. (CVE-2007-1001) - A vulnerability in the way the mbstring extension setglobal variables was discovered where a script using the mb_parse_str() function to set global variables could be forced to to enable the register_globals configuration option, possibly resulting in global variable injection. (CVE-2007-1583) - A context-dependent attacker could read portions of heap memory by executing certain scripts with a serialized data input string beginning with 'S:', which did not properly track the number of input bytes being processed. (CVE-2007-1649) - A vulnerability in how PHP's mail() function processed email messages, truncating potentially important information after the first ASCIIZ (\0) byte. (CVE-2007-1717) - A vulnerability in how PHP's mail() function processed header data was discovered. If a script sent mail using a subject header containing a string from an untrusted source, a remote attacker could send bulk email to unintended recipients (CVE-2007-1718)." ); script_set_attribute(attribute:"see_also", value:"http://www.php.net/releases/5_2_2.php"); script_set_attribute(attribute:"solution", value:"Upgrade to PHP version 5.2.2 or later."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N"); script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"); script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2007-1649"); script_set_attribute(attribute:"exploitability_ease", value:"No exploit is required"); script_set_attribute(attribute:"exploit_available", value:"false"); script_set_attribute(attribute:"vuln_publication_date", value:"2007/03/23"); script_set_attribute(attribute:"patch_publication_date", value:"2007/05/03"); script_set_attribute(attribute:"plugin_publication_date", value:"2012/01/11"); script_set_attribute(attribute:"plugin_type", value:"remote"); script_set_attribute(attribute:"cpe", value:"cpe:/a:php:php"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"CGI abuses"); script_copyright(english:"This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("php_version.nasl"); script_require_ports("Services/www", 80); script_require_keys("www/PHP"); exit(0); } include("global_settings.inc"); include("misc_func.inc"); include("http.inc"); include("audit.inc"); include("webapp_func.inc"); port = get_http_port(default:80, php:TRUE); php = get_php_from_kb( port : port, exit_on_fail : TRUE ); version = php["ver"]; source = php["src"]; backported = get_kb_item('www/php/'+port+'/'+version+'/backported'); if (report_paranoia < 2 && backported) audit(AUDIT_BACKPORT_SERVICE, port, "PHP "+version+" install"); if (version !~ "^5\.") exit(0, "The web server on port "+port+" uses PHP "+version+" rather than 5.x."); if (version =~ "^5\.([01]\..*|2\.[01])($|[^0-9])") { if (report_verbosity > 0) { report = '\n Version source : '+source + '\n Installed version : '+version+ '\n Fixed version : 5.2.2\n'; security_hole(port:port, extra:report); } else security_hole(port); exit(0); } else audit(AUDIT_LISTEN_NOT_VULN, "PHP", port, version);
NASL family SuSE Local Security Checks NASL id SUSE_APACHE2-MOD_PHP5-3289.NASL description This Update fixes numerous vulnerabilities in PHP. Most of them were made public during the last seen 2020-06-01 modified 2020-06-02 plugin id 27150 published 2007-10-17 reporter This script is Copyright (C) 2007-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/27150 title openSUSE 10 Security Update : apache2-mod_php5 (apache2-mod_php5-3289) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from openSUSE Security Update apache2-mod_php5-3289. # # The text description of this plugin is (C) SUSE LLC. # include("compat.inc"); if (description) { script_id(27150); script_version ("1.14"); script_cvs_date("Date: 2019/10/25 13:36:29"); script_cve_id("CVE-2007-0988", "CVE-2007-1001", "CVE-2007-1375", "CVE-2007-1376", "CVE-2007-1380", "CVE-2007-1453", "CVE-2007-1454", "CVE-2007-1460", "CVE-2007-1461", "CVE-2007-1484", "CVE-2007-1521", "CVE-2007-1522", "CVE-2007-1583", "CVE-2007-1700", "CVE-2007-1717", "CVE-2007-1718", "CVE-2007-1824", "CVE-2007-1889"); script_name(english:"openSUSE 10 Security Update : apache2-mod_php5 (apache2-mod_php5-3289)"); script_summary(english:"Check for the apache2-mod_php5-3289 patch"); script_set_attribute( attribute:"synopsis", value:"The remote openSUSE host is missing a security update." ); script_set_attribute( attribute:"description", value: "This Update fixes numerous vulnerabilities in PHP. Most of them were made public during the 'Month of PHP Bugs'. The vulnerabilities potentially lead to crashes, information leaks or even execution of malicious code. CVE-2007-1380, CVE-2007-0988, CVE-2007-1375, CVE-2007-1454 CVE-2007-1453, CVE-2007-1521, CVE-2007-1522, CVE-2007-1376 CVE-2007-1583, CVE-2007-1460, CVE-2007-1461, CVE-2007-1484 CVE-2007-1700, CVE-2007-1717, CVE-2007-1718, CVE-2007-1001 CVE-2007-1824, CVE-2007-1889, CVE-2007-1900" ); script_set_attribute( attribute:"solution", value:"Update the affected apache2-mod_php5 packages." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N"); script_cwe_id(399); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:apache2-mod_php5"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-bcmath"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-bz2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-calendar"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-ctype"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-curl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-dba"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-dbase"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-dom"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-exif"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-fastcgi"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-ftp"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-gd"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-gettext"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-gmp"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-hash"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-iconv"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-imap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-json"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-ldap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-mbstring"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-mcrypt"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-mhash"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-mysql"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-ncurses"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-odbc"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-openssl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-pcntl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-pdo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-pear"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-pgsql"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-posix"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-pspell"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-shmop"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-snmp"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-soap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-sockets"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-sqlite"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-suhosin"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-sysvmsg"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-sysvsem"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-sysvshm"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-tidy"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-tokenizer"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-wddx"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-xmlreader"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-xmlrpc"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-xmlwriter"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-xsl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-zip"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-zlib"); script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:10.2"); script_set_attribute(attribute:"patch_publication_date", value:"2007/05/08"); script_set_attribute(attribute:"plugin_publication_date", value:"2007/10/17"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2007-2019 Tenable Network Security, Inc."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/SuSE/release"); if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE"); if (release !~ "^(SUSE10\.2)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "10.2", release); if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); ourarch = get_kb_item("Host/cpu"); if (!ourarch) audit(AUDIT_UNKNOWN_ARCH); if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch); flag = 0; if ( rpm_check(release:"SUSE10.2", reference:"apache2-mod_php5-5.2.0-14") ) flag++; if ( rpm_check(release:"SUSE10.2", reference:"php5-5.2.0-14") ) flag++; if ( rpm_check(release:"SUSE10.2", reference:"php5-bcmath-5.2.0-14") ) flag++; if ( rpm_check(release:"SUSE10.2", reference:"php5-bz2-5.2.0-14") ) flag++; if ( rpm_check(release:"SUSE10.2", reference:"php5-calendar-5.2.0-14") ) flag++; if ( rpm_check(release:"SUSE10.2", reference:"php5-ctype-5.2.0-14") ) flag++; if ( rpm_check(release:"SUSE10.2", reference:"php5-curl-5.2.0-14") ) flag++; if ( rpm_check(release:"SUSE10.2", reference:"php5-dba-5.2.0-14") ) flag++; if ( rpm_check(release:"SUSE10.2", reference:"php5-dbase-5.2.0-14") ) flag++; if ( rpm_check(release:"SUSE10.2", reference:"php5-devel-5.2.0-14") ) flag++; if ( rpm_check(release:"SUSE10.2", reference:"php5-dom-5.2.0-14") ) flag++; if ( rpm_check(release:"SUSE10.2", reference:"php5-exif-5.2.0-14") ) flag++; if ( rpm_check(release:"SUSE10.2", reference:"php5-fastcgi-5.2.0-14") ) flag++; if ( rpm_check(release:"SUSE10.2", reference:"php5-ftp-5.2.0-14") ) flag++; if ( rpm_check(release:"SUSE10.2", reference:"php5-gd-5.2.0-14") ) flag++; if ( rpm_check(release:"SUSE10.2", reference:"php5-gettext-5.2.0-14") ) flag++; if ( rpm_check(release:"SUSE10.2", reference:"php5-gmp-5.2.0-14") ) flag++; if ( rpm_check(release:"SUSE10.2", reference:"php5-hash-5.2.0-14") ) flag++; if ( rpm_check(release:"SUSE10.2", reference:"php5-iconv-5.2.0-14") ) flag++; if ( rpm_check(release:"SUSE10.2", reference:"php5-imap-5.2.0-14") ) flag++; if ( rpm_check(release:"SUSE10.2", reference:"php5-json-5.2.0-14") ) flag++; if ( rpm_check(release:"SUSE10.2", reference:"php5-ldap-5.2.0-14") ) flag++; if ( rpm_check(release:"SUSE10.2", reference:"php5-mbstring-5.2.0-14") ) flag++; if ( rpm_check(release:"SUSE10.2", reference:"php5-mcrypt-5.2.0-14") ) flag++; if ( rpm_check(release:"SUSE10.2", reference:"php5-mhash-5.2.0-14") ) flag++; if ( rpm_check(release:"SUSE10.2", reference:"php5-mysql-5.2.0-14") ) flag++; if ( rpm_check(release:"SUSE10.2", reference:"php5-ncurses-5.2.0-14") ) flag++; if ( rpm_check(release:"SUSE10.2", reference:"php5-odbc-5.2.0-14") ) flag++; if ( rpm_check(release:"SUSE10.2", reference:"php5-openssl-5.2.0-14") ) flag++; if ( rpm_check(release:"SUSE10.2", reference:"php5-pcntl-5.2.0-14") ) flag++; if ( rpm_check(release:"SUSE10.2", reference:"php5-pdo-5.2.0-14") ) flag++; if ( rpm_check(release:"SUSE10.2", reference:"php5-pear-5.2.0-14") ) flag++; if ( rpm_check(release:"SUSE10.2", reference:"php5-pgsql-5.2.0-14") ) flag++; if ( rpm_check(release:"SUSE10.2", reference:"php5-posix-5.2.0-14") ) flag++; if ( rpm_check(release:"SUSE10.2", reference:"php5-pspell-5.2.0-14") ) flag++; if ( rpm_check(release:"SUSE10.2", reference:"php5-shmop-5.2.0-14") ) flag++; if ( rpm_check(release:"SUSE10.2", reference:"php5-snmp-5.2.0-14") ) flag++; if ( rpm_check(release:"SUSE10.2", reference:"php5-soap-5.2.0-14") ) flag++; if ( rpm_check(release:"SUSE10.2", reference:"php5-sockets-5.2.0-14") ) flag++; if ( rpm_check(release:"SUSE10.2", reference:"php5-sqlite-5.2.0-14") ) flag++; if ( rpm_check(release:"SUSE10.2", reference:"php5-suhosin-5.2.0-14") ) flag++; if ( rpm_check(release:"SUSE10.2", reference:"php5-sysvmsg-5.2.0-14") ) flag++; if ( rpm_check(release:"SUSE10.2", reference:"php5-sysvsem-5.2.0-14") ) flag++; if ( rpm_check(release:"SUSE10.2", reference:"php5-sysvshm-5.2.0-14") ) flag++; if ( rpm_check(release:"SUSE10.2", reference:"php5-tidy-5.2.0-14") ) flag++; if ( rpm_check(release:"SUSE10.2", reference:"php5-tokenizer-5.2.0-14") ) flag++; if ( rpm_check(release:"SUSE10.2", reference:"php5-wddx-5.2.0-14") ) flag++; if ( rpm_check(release:"SUSE10.2", reference:"php5-xmlreader-5.2.0-14") ) flag++; if ( rpm_check(release:"SUSE10.2", reference:"php5-xmlrpc-5.2.0-14") ) flag++; if ( rpm_check(release:"SUSE10.2", reference:"php5-xmlwriter-5.2.0-14") ) flag++; if ( rpm_check(release:"SUSE10.2", reference:"php5-xsl-5.2.0-14") ) flag++; if ( rpm_check(release:"SUSE10.2", reference:"php5-zip-5.2.0-14") ) flag++; if ( rpm_check(release:"SUSE10.2", reference:"php5-zlib-5.2.0-14") ) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get()); else security_hole(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "apache2-mod_php5 / php5 / php5-bcmath / php5-bz2 / php5-calendar / etc"); }
NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-200705-19.NASL description The remote host is affected by the vulnerability described in GLSA-200705-19 (PHP: Multiple vulnerabilities) Several vulnerabilities were found in PHP, most of them during the Month Of PHP Bugs (MOPB) by Stefan Esser. The most severe of these vulnerabilities are integer overflows in wbmp.c from the GD library (CVE-2007-1001) and in the substr_compare() PHP 5 function (CVE-2007-1375). Ilia Alshanetsky also reported a buffer overflow in the make_http_soap_request() and in the user_filter_factory_create() functions (CVE-2007-2510, CVE-2007-2511), and Stanislav Malyshev discovered another buffer overflow in the bundled XMLRPC library (CVE-2007-1864). Additionally, the session_regenerate_id() and the array_user_key_compare() functions contain a double-free vulnerability (CVE-2007-1484, CVE-2007-1521). Finally, there exist implementation errors in the Zend engine, in the mb_parse_str(), the unserialize() and the mail() functions and other elements. Impact : Remote attackers might be able to exploit these issues in PHP applications making use of the affected functions, potentially resulting in the execution of arbitrary code, Denial of Service, execution of scripted contents in the context of the affected site, security bypass or information leak. Workaround : There is no known workaround at this time. last seen 2020-06-01 modified 2020-06-02 plugin id 25340 published 2007-05-29 reporter This script is Copyright (C) 2007-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/25340 title GLSA-200705-19 : PHP: Multiple vulnerabilities code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Gentoo Linux Security Advisory GLSA 200705-19. # # The advisory text is Copyright (C) 2001-2016 Gentoo Foundation, Inc. # and licensed under the Creative Commons - Attribution / Share Alike # license. See http://creativecommons.org/licenses/by-sa/3.0/ # include("compat.inc"); if (description) { script_id(25340); script_version("1.17"); script_cvs_date("Date: 2019/08/02 13:32:44"); script_cve_id("CVE-2007-1001", "CVE-2007-1285", "CVE-2007-1286", "CVE-2007-1484", "CVE-2007-1521", "CVE-2007-1583", "CVE-2007-1700", "CVE-2007-1701", "CVE-2007-1711", "CVE-2007-1717", "CVE-2007-1718", "CVE-2007-1864", "CVE-2007-1900", "CVE-2007-2509", "CVE-2007-2510", "CVE-2007-2511"); script_xref(name:"GLSA", value:"200705-19"); script_name(english:"GLSA-200705-19 : PHP: Multiple vulnerabilities"); script_summary(english:"Checks for updated package(s) in /var/db/pkg"); script_set_attribute( attribute:"synopsis", value: "The remote Gentoo host is missing one or more security-related patches." ); script_set_attribute( attribute:"description", value: "The remote host is affected by the vulnerability described in GLSA-200705-19 (PHP: Multiple vulnerabilities) Several vulnerabilities were found in PHP, most of them during the Month Of PHP Bugs (MOPB) by Stefan Esser. The most severe of these vulnerabilities are integer overflows in wbmp.c from the GD library (CVE-2007-1001) and in the substr_compare() PHP 5 function (CVE-2007-1375). Ilia Alshanetsky also reported a buffer overflow in the make_http_soap_request() and in the user_filter_factory_create() functions (CVE-2007-2510, CVE-2007-2511), and Stanislav Malyshev discovered another buffer overflow in the bundled XMLRPC library (CVE-2007-1864). Additionally, the session_regenerate_id() and the array_user_key_compare() functions contain a double-free vulnerability (CVE-2007-1484, CVE-2007-1521). Finally, there exist implementation errors in the Zend engine, in the mb_parse_str(), the unserialize() and the mail() functions and other elements. Impact : Remote attackers might be able to exploit these issues in PHP applications making use of the affected functions, potentially resulting in the execution of arbitrary code, Denial of Service, execution of scripted contents in the context of the affected site, security bypass or information leak. Workaround : There is no known workaround at this time." ); script_set_attribute( attribute:"see_also", value:"https://security.gentoo.org/glsa/200705-19" ); script_set_attribute( attribute:"solution", value: "All PHP 5 users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose '>=dev-lang/php-5.2.2' All PHP 4 users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose '>=dev-lang/php-4.4.7'" ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:N"); script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"metasploit_name", value:'PHP 4 unserialize() ZVAL Reference Counter Overflow (Cookie)'); script_set_attribute(attribute:"exploit_framework_metasploit", value:"true"); script_cwe_id(20, 119); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:php"); script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux"); script_set_attribute(attribute:"patch_publication_date", value:"2007/05/26"); script_set_attribute(attribute:"plugin_publication_date", value:"2007/05/29"); script_set_attribute(attribute:"vuln_publication_date", value:"2007/03/01"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2007-2019 Tenable Network Security, Inc."); script_family(english:"Gentoo Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("qpkg.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo"); if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING); flag = 0; if (qpkg_check(package:"dev-lang/php", unaffected:make_list("rge 4.4.7", "rge 4.4.8_pre20070816", "ge 5.2.2"), vulnerable:make_list("lt 5.2.2"))) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get()); else security_hole(0); exit(0); } else { tested = qpkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "PHP"); }
NASL family Mandriva Local Security Checks NASL id MANDRAKE_MDKSA-2007-089.NASL description A heap-based buffer overflow vulnerability was found in PHP last seen 2020-06-01 modified 2020-06-02 plugin id 25113 published 2007-04-30 reporter This script is Copyright (C) 2007-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/25113 title Mandrake Linux Security Advisory : php (MDKSA-2007:089) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Mandrake Linux Security Advisory MDKSA-2007:089. # The text itself is copyright (C) Mandriva S.A. # include("compat.inc"); if (description) { script_id(25113); script_version ("1.17"); script_cvs_date("Date: 2019/08/02 13:32:49"); script_cve_id("CVE-2007-1001", "CVE-2007-1285", "CVE-2007-1583", "CVE-2007-1717", "CVE-2007-1718", "CVE-2007-1887"); script_bugtraq_id(22764, 23016, 23145, 23357); script_xref(name:"MDKSA", value:"2007:089"); script_name(english:"Mandrake Linux Security Advisory : php (MDKSA-2007:089)"); script_summary(english:"Checks rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value: "The remote Mandrake Linux host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "A heap-based buffer overflow vulnerability was found in PHP's gd extension. A script that could be forced to process WBMP images from an untrusted source could result in arbitrary code execution (CVE-2007-1001). A DoS flaw was found in how PHP processed a deeply nested array. A remote attacker could cause the PHP intrerpreter to creash by submitting an input variable with a deeply nested array (CVE-2007-1285). A vulnerability in the way the mbstring extension set global variables was discovered where a script using the mb_parse_str() function to set global variables could be forced to to enable the register_globals configuration option, possibly resulting in global variable injection (CVE-2007-1583). A vulnerability in how PHP's mail() function processed header data was discovered. If a script sent mail using a subject header containing a string from an untrusted source, a remote attacker could send bulk email to unintended recipients (CVE-2007-1718). A buffer overflow in the sqlite_decode_function() in the bundled sqlite library could allow context-dependent attackers to execute arbitrary code (CVE-2007-1887). Updated packages have been patched to correct these issues. Also note that the default use of the Hardened PHP patch helped to protect against some of these issues prior to patching." ); script_set_attribute(attribute:"solution", value:"Update the affected packages."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:N"); script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:lib64php5_common5"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:libphp5_common5"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:php-cgi"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:php-cli"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:php-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:php-fcgi"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:php-gd"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:php-mbstring"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:php-sqlite"); script_set_attribute(attribute:"cpe", value:"cpe:/o:mandriva:linux:2007"); script_set_attribute(attribute:"patch_publication_date", value:"2007/04/18"); script_set_attribute(attribute:"plugin_publication_date", value:"2007/04/30"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2007-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Mandriva Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/Mandrake/release", "Host/Mandrake/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/Mandrake/release")) audit(AUDIT_OS_NOT, "Mandriva / Mandake Linux"); if (!get_kb_item("Host/Mandrake/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if (cpu !~ "^(amd64|i[3-6]86|x86_64)$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Mandriva / Mandrake Linux", cpu); flag = 0; if (rpm_check(release:"MDK2007.0", cpu:"x86_64", reference:"lib64php5_common5-5.1.6-1.7mdv2007.0", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.0", cpu:"i386", reference:"libphp5_common5-5.1.6-1.7mdv2007.0", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.0", reference:"php-cgi-5.1.6-1.7mdv2007.0", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.0", reference:"php-cli-5.1.6-1.7mdv2007.0", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.0", reference:"php-devel-5.1.6-1.7mdv2007.0", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.0", reference:"php-fcgi-5.1.6-1.7mdv2007.0", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.0", reference:"php-gd-5.1.6-1.2mdv2007.0", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.0", reference:"php-mbstring-5.1.6-1.1mdv2007.0", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.0", reference:"php-sqlite-5.1.6-1.1mdv2007.0", yank:"mdv")) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get()); else security_hole(0); exit(0); } else audit(AUDIT_HOST_NOT, "affected");
NASL family SuSE Local Security Checks NASL id SUSE_APACHE2-MOD_PHP5-3290.NASL description This Update fixes numerous vulnerabilities in PHP. Most of them were made public during the last seen 2020-06-01 modified 2020-06-02 plugin id 29378 published 2007-12-13 reporter This script is Copyright (C) 2007-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/29378 title SuSE 10 Security Update : PHP5 (ZYPP Patch Number 3290) NASL family CGI abuses NASL id PHP_4_4_7_OR_5_2_2.NASL description According to its banner, the version of PHP installed on the remote host is older than 4.4.7 / 5.2.2. Such versions may be affected by several issues, including buffer overflows in the GD library. last seen 2020-06-01 modified 2020-06-02 plugin id 25159 published 2007-05-04 reporter This script is Copyright (C) 2007-2018 Westpoint Limited. source https://www.tenable.com/plugins/nessus/25159 title PHP < 4.4.7 / 5.2.2 Multiple Vulnerabilities NASL family MacOS X Local Security Checks NASL id MACOSX_SECUPD2007-007.NASL description The remote host is running a version of Mac OS X 10.4 or 10.3 which does not have the security update 2007-007 applied. This update contains several security fixes for the following programs : - bzip2 - CFNetwork - CoreAudio - cscope - gnuzip - iChat - Kerberos - mDNSResponder - PDFKit - PHP - Quartz Composer - Samba - SquirrelMail - Tomcat - WebCore - WebKit last seen 2020-06-01 modified 2020-06-02 plugin id 25830 published 2007-08-02 reporter This script is Copyright (C) 2007-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/25830 title Mac OS X Multiple Vulnerabilities (Security Update 2007-007) NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-455-1.NASL description Stefan Esser discovered multiple vulnerabilities in the last seen 2020-06-01 modified 2020-06-02 plugin id 28053 published 2007-11-10 reporter Ubuntu Security Notice (C) 2007-2019 Canonical, Inc. / NASL script (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/28053 title Ubuntu 6.06 LTS / 6.10 / 7.04 : php5 vulnerabilities (USN-455-1)
Seebug
bulletinFamily | exploit |
description | CVE(CAN) ID: CVE-2004-0996,CVE-2004-2541,CVE-2005-0758,CVE-2005-3128,CVE-2006-2842,CVE-2006-3174,CVE-2006-4019,CVE-2006-6142,CVE-2007-0450,CVE-2007-0478,CVE-2007-1001,CVE-2007-1262,CVE-2007-1358,CVE-2007-1460,CVE-2007-1461,CVE-2007-1484,CVE-2007-1521,CVE-2007-1583,CVE-2007-1711,CVE-2007-1717,CVE-2007-1860,CVE-2007-2403,CVE-2007-2404,CVE-2007-2405,CVE-2007-2406,CVE-2007-2407,CVE-2007-2408,CVE-2007-2409,CVE-2007-2410,CVE-2007-2442,CVE-2007-2443,CVE-2007-2446,CVE-2007-2447,CVE-2007-2589,CVE-2007-2798,CVE-2007-3742,CVE-2007-3744,CVE-2007-3745,CVE-2007-3746,CVE-2007-3747,CVE-2007-3748,CVE-2007-3944 Mac OS X是苹果家族计算机所使用的操作系统。 Apple 2007-007安全更新修复了Mac OS X中的多个安全漏洞,远程或本地攻击者可能利用这些漏洞造成多种威胁。 具体条目包括: * CVE-2005-0758 bzgrep在处理畸形文件名时存在漏洞,攻击者通过诱使用户bzgrep恶意文件执行任意指令。 * CVE-2007-2403 Mac OS X在处理FTP URI时存在漏洞,攻击者可以诱使用户处理恶意FTP URI的用户在当前FTP会话中执行任意命令。 * CVE-2007-2404 CFNetwork处理HTTP回应数据时易受数据分割攻击的影响,可能导致跨站脚本执行。 * CVE-2007-3745 CoreAudio的Java接口允许释放任意的内存地址,远程攻击者可能利用此漏洞通过诱使用户访问一个恶意网页控制用户系统。 * CVE-2007-3746 CoreAudio的Java接口存在堆块边界访问漏洞,远程攻击者可能利用此漏洞通过诱使用户访问一个恶意网页控制用户系统。 * CVE-2007-3747 CoreAudio的Java接口允许在堆块以外的内存初始化或操作对象,远程攻击者可能利用此漏洞通过诱使用户访问一个恶意网页控制用户系统。 * CVE-2004-0996,CVE-2004-2541 Cscope存在多个漏洞,包括缓冲区溢出和不安全的方式创建临时文件,可能导致远程攻击者控制系统。 * CVE-2005-0758 zgrep在处理畸形文件名时存在漏洞,攻击者通过诱使用户zgrep恶意文件执行任意指令。 * CVE-2007-3748 iChat使用的UPnP IGD代码实现上存在缓冲区溢出漏洞,本地网络上的远程攻击者可能利用此漏洞导致拒绝服务或执行任意指令。 * CVE-2007-2442,CVE-2007-2443,CVE-2007-2798 MIT Kerberos kadmind实现上存在多个漏洞,攻击者可能利用这些漏洞导致拒绝服务或执行任意指认。 * CVE-2007-3744 mDNSResponder使用的UPnP IGD代码实现上存在缓冲区溢出漏洞,本地网络上的远程攻击者可能利用此漏洞导致拒绝服务或执行任意指令。 * CVE-2007-2405 Preview处理PDF文件的实现上存在整数溢出漏洞,攻击者可能利用此漏洞诱使用户处理恶意PDF文件控制用户系统。 * CVE-2007-1001,CVE-2007-1287,CVE-2007-1460,CVE-2007-1461,CVE-2007-1484,CVE-2007-1521,CVE-2007-1583,CVE-2007-1711,CVE-2007-1717 PHP的实现上存在多个漏洞,可能导致各种攻击。 * CVE-2007-2406 Quartz Composer实现上存在未初始化对象指针处理漏洞,攻击者可能诱使用户处理恶意文件控制用户系统。 * CVE-2007-2446 Samba的实现在处理畸形的RPC请求时存在堆缓冲区溢出漏洞,远程攻击者可能利用此漏洞控制服务器。 * CVE-2007-2447 Samba的实现在处理畸形RPC请求时存在命令注入漏洞,远程攻击者可能利用此漏洞在服务器上执行任意命令。 * CVE-2007-2407 Samba的实现没有正确地处理权限的丢弃,导致磁盘限额绕过。 * CVE-2005-3128,CVE-2006-2842,CVE-2006-3174,CVE-2006-4019,CVE-2006-6142,CVE-2007-1262,CVE-2007-2589 SquirrelMail的实现上存在多个漏洞,可能导致跨站脚本执行。 * CVE-2005-2090,CVE-2007-0450,CVE-2007-1358,CVE-2007-1860 Tomcat实现上存在多个漏洞,可能导致跨站脚本执行和信息泄露。 * CVE-2007-2408 WebCore软件包实现上存在漏洞,可能导致不期望的Java applet执行。 * CVE-2007-0478 WebCore软件包在处理HTML标题的代码上存在漏洞,允许远程用户插入代码。 * CVE-2007-2409,CVE-2007-2410 WebCore软件包的实现上存在漏洞,可能导致浏览器信息泄露。 * CVE-2007-3742 WebKit软件包实现上存在漏洞,可能导致域名欺骗。 * CVE-2007-3944 Safari的JavaScript引擎使用的PCRE库实现上存在堆溢出漏洞,远程攻击者可能利用此漏洞通过诱使用户访问恶意网页控制用户系统。 Apple MacOS X 厂商补丁: Apple ----- 目前厂商已经发布了升级补丁以修复这个安全问题,请到厂商的主页下载: <a href="http://docs.info.apple.com/article.html?artnum=306172" target="_blank">http://docs.info.apple.com/article.html?artnum=306172</a> |
id | SSV:2062 |
last seen | 2017-11-19 |
modified | 2007-08-02 |
published | 2007-08-02 |
reporter | Root |
title | Mac OS X 2007-007更新修复多个安全漏洞 |
Statements
contributor | Mark J Cox |
lastmodified | 2007-05-04 |
organization | Red Hat |
statement | This issue has no security impact. |
References
- http://docs.info.apple.com/article.html?artnum=306172
- http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html
- http://secunia.com/advisories/25056
- http://secunia.com/advisories/25445
- http://secunia.com/advisories/26235
- http://security.gentoo.org/glsa/glsa-200705-19.xml
- http://us2.php.net/releases/4_4_7.php
- http://us2.php.net/releases/5_2_2.php
- http://www.novell.com/linux/security/advisories/2007_32_php.html
- http://www.php-security.org/MOPB/MOPB-33-2007.html
- http://www.securityfocus.com/bid/23146
- http://www.securityfocus.com/bid/25159
- http://www.vupen.com/english/advisories/2007/2732
- https://exchange.xforce.ibmcloud.com/vulnerabilities/33518