Vulnerabilities > CVE-2007-4660 - Resource Management Errors vulnerability in PHP

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
php
CWE-399
nessus

Summary

Unspecified vulnerability in the chunk_split function in PHP before 5.2.4 has unknown impact and attack vectors, related to an incorrect size calculation.

Vulnerable Configurations

Part Description Count
Application
Php
328

Common Weakness Enumeration (CWE)

Nessus

  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-200710-02.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-200710-02 (PHP: Multiple vulnerabilities) Several vulnerabilities were found in PHP. Mattias Bengtsson and Philip Olausson reported integer overflows in the gdImageCreate() and gdImageCreateTrueColor() functions of the GD library which can cause heap-based buffer overflows (CVE-2007-3996). Gerhard Wagner discovered an integer overflow in the chunk_split() function that can lead to a heap-based buffer overflow (CVE-2007-2872). Its incomplete fix caused incorrect buffer size calculation due to precision loss, also resulting in a possible heap-based buffer overflow (CVE-2007-4661 and CVE-2007-4660). A buffer overflow in the sqlite_decode_binary() of the SQLite extension found by Stefan Esser that was addressed in PHP 5.2.1 was not fixed correctly (CVE-2007-1887). Stefan Esser discovered an error in the zend_alter_ini_entry() function handling a memory_limit violation (CVE-2007-4659). Stefan Esser also discovered a flaw when handling interruptions with userspace error handlers that can be exploited to read arbitrary heap memory (CVE-2007-1883). Disclosure of sensitive memory can also be triggered due to insufficient boundary checks in the strspn() and strcspn() functions, an issue discovered by Mattias Bengtsson and Philip Olausson (CVE-2007-4657) Stefan Esser reported incorrect validation in the FILTER_VALIDATE_EMAIL filter of the Filter extension allowing arbitrary email header injection (CVE-2007-1900). NOTE: This CVE was referenced, but not fixed in GLSA 200705-19. Stanislav Malyshev found an error with unknown impact in the money_format() function when processing
    last seen2020-06-01
    modified2020-06-02
    plugin id26942
    published2007-10-09
    reporterThis script is Copyright (C) 2007-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/26942
    titleGLSA-200710-02 : PHP: Multiple vulnerabilities
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Gentoo Linux Security Advisory GLSA 200710-02.
    #
    # The advisory text is Copyright (C) 2001-2018 Gentoo Foundation, Inc.
    # and licensed under the Creative Commons - Attribution / Share Alike 
    # license. See http://creativecommons.org/licenses/by-sa/3.0/
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(26942);
      script_version("1.25");
      script_cvs_date("Date: 2019/08/02 13:32:44");
    
      script_cve_id("CVE-2007-1883", "CVE-2007-1887", "CVE-2007-1900", "CVE-2007-2756", "CVE-2007-2872", "CVE-2007-3007", "CVE-2007-3378", "CVE-2007-3806", "CVE-2007-3996", "CVE-2007-3997", "CVE-2007-3998", "CVE-2007-4652", "CVE-2007-4657", "CVE-2007-4658", "CVE-2007-4659", "CVE-2007-4660", "CVE-2007-4661", "CVE-2007-4662", "CVE-2007-4663", "CVE-2007-4670", "CVE-2007-4727", "CVE-2007-4782", "CVE-2007-4783", "CVE-2007-4784", "CVE-2007-4825", "CVE-2007-4840", "CVE-2007-4887");
      script_xref(name:"GLSA", value:"200710-02");
    
      script_name(english:"GLSA-200710-02 : PHP: Multiple vulnerabilities");
      script_summary(english:"Checks for updated package(s) in /var/db/pkg");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Gentoo host is missing one or more security-related
    patches."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "The remote host is affected by the vulnerability described in GLSA-200710-02
    (PHP: Multiple vulnerabilities)
    
        Several vulnerabilities were found in PHP. Mattias Bengtsson and Philip
        Olausson reported integer overflows in the gdImageCreate() and
        gdImageCreateTrueColor() functions of the GD library which can cause
        heap-based buffer overflows (CVE-2007-3996). Gerhard Wagner discovered
        an integer overflow in the chunk_split() function that can lead to a
        heap-based buffer overflow (CVE-2007-2872). Its incomplete fix caused
        incorrect buffer size calculation due to precision loss, also resulting
        in a possible heap-based buffer overflow (CVE-2007-4661 and
        CVE-2007-4660). A buffer overflow in the sqlite_decode_binary() of the
        SQLite extension found by Stefan Esser that was addressed in PHP 5.2.1
        was not fixed correctly (CVE-2007-1887).
        Stefan Esser discovered an error in the zend_alter_ini_entry() function
        handling a memory_limit violation (CVE-2007-4659). Stefan Esser also
        discovered a flaw when handling interruptions with userspace error
        handlers that can be exploited to read arbitrary heap memory
        (CVE-2007-1883). Disclosure of sensitive memory can also be triggered
        due to insufficient boundary checks in the strspn() and strcspn()
        functions, an issue discovered by Mattias Bengtsson and Philip Olausson
        (CVE-2007-4657)
        Stefan Esser reported incorrect validation in the FILTER_VALIDATE_EMAIL
        filter of the Filter extension allowing arbitrary email header
        injection (CVE-2007-1900). NOTE: This CVE was referenced, but not fixed
        in GLSA 200705-19.
        Stanislav Malyshev found an error with unknown impact in the
        money_format() function when processing '%i' and '%n' tokens
        (CVE-2007-4658). zatanzlatan reported a buffer overflow in the
        php_openssl_make_REQ() function with unknown impact when providing a
        manipulated SSL configuration file (CVE-2007-4662). Possible memory
        corruption when trying to read EXIF data in exif_read_data() and
        exif_thumbnail() occurred with unknown impact.
        Several vulnerabilities that allow bypassing of open_basedir and other
        restrictions were reported, including the glob() function
        (CVE-2007-4663), the session_save_path(), ini_set(), and error_log()
        functions which can allow local command execution (CVE-2007-3378),
        involving the readfile() function (CVE-2007-3007), via the Session
        extension (CVE-2007-4652), via the MySQL extension (CVE-2007-3997) and
        in the dl() function which allows loading extensions outside of the
        specified directory (CVE-2007-4825).
        Multiple Denial of Service vulnerabilities were discovered, including a
        long 'library' parameter in the dl() function (CVE-2007-4887), in
        several iconv and xmlrpc functions (CVE-2007-4840 and CVE-2007-4783),
        in the setlocale() function (CVE-2007-4784), in the glob() and
        fnmatch() function (CVE-2007-4782 and CVE-2007-3806), a floating point
        exception in the wordwrap() function (CVE-2007-3998), a stack
        exhaustion via deeply nested arrays (CVE-2007-4670), an infinite loop
        caused by a specially crafted PNG image in the png_read_info() function
        of libpng (CVE-2007-2756) and several issues related to array
        conversion.
      
    Impact :
    
        Remote attackers might be able to exploit these issues in PHP
        applications making use of the affected functions, potentially
        resulting in the execution of arbitrary code, Denial of Service,
        execution of scripted contents in the context of the affected site,
        security bypass or information leak.
      
    Workaround :
    
        There is no known workaround at this time."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security.gentoo.org/glsa/200705-19"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security.gentoo.org/glsa/200710-02"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "All PHP users should upgrade to the latest version:
        # emerge --sync
        # emerge --ask --oneshot --verbose '>=dev-lang/php-5.2.4_p20070914-r2'"
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N");
      script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'D2ExploitPack');
      script_cwe_id(20, 22, 94, 119, 189, 264, 362, 399);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:php");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2007/10/07");
      script_set_attribute(attribute:"plugin_publication_date", value:"2007/10/09");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2007-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Gentoo Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("qpkg.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo");
    if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    
    if (qpkg_check(package:"dev-lang/php", unaffected:make_list("ge 5.2.4_p20070914-r2"), vulnerable:make_list("lt 5.2.4_p20070914-r2"))) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = qpkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "PHP");
    }
    
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-1444.NASL
    descriptionIt was discovered that the patch for CVE-2007-4659 could lead to regressions in some scenarios. The fix has been reverted for now, a revised update will be provided in a future PHP DSA. For reference the original advisory below : Several remote vulnerabilities have been discovered in PHP, a server-side, HTML-embedded scripting language. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2007-3799 It was discovered that the session_start() function allowed the insertion of attributes into the session cookie. - CVE-2007-3998 Mattias Bengtsson and Philip Olausson discovered that a programming error in the implementation of the wordwrap() function allowed denial of service through an infinite loop. - CVE-2007-4658 Stanislav Malyshev discovered that a format string vulnerability in the money_format() function could allow the execution of arbitrary code. - CVE-2007-4659 Stefan Esser discovered that execution control flow inside the zend_alter_ini_entry() function is handled incorrectly in case of a memory limit violation. - CVE-2007-4660 Gerhard Wagner discovered an integer overflow inside the chunk_split() function. - CVE-2007-5898 Rasmus Lerdorf discovered that incorrect parsing of multibyte sequences may lead to disclosure of memory contents. - CVE-2007-5899 It was discovered that the output_add_rewrite_var() function could leak session ID information, resulting in information disclosure. This update also fixes two bugs from the PHP 5.2.4 release which don
    last seen2020-06-01
    modified2020-06-02
    plugin id29838
    published2008-01-04
    reporterThis script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/29838
    titleDebian DSA-1444-2 : php5 - several vulnerabilities
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Debian Security Advisory DSA-1444. The text 
    # itself is copyright (C) Software in the Public Interest, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(29838);
      script_version("1.24");
      script_cvs_date("Date: 2019/08/02 13:32:21");
    
      script_cve_id("CVE-2007-3799", "CVE-2007-3998", "CVE-2007-4657", "CVE-2007-4658", "CVE-2007-4659", "CVE-2007-4660", "CVE-2007-4662", "CVE-2007-5898", "CVE-2007-5899");
      script_bugtraq_id(24268, 25498, 26403);
      script_xref(name:"DSA", value:"1444");
    
      script_name(english:"Debian DSA-1444-2 : php5 - several vulnerabilities");
      script_summary(english:"Checks dpkg output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Debian host is missing a security-related update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "It was discovered that the patch for CVE-2007-4659 could lead to
    regressions in some scenarios. The fix has been reverted for now, a
    revised update will be provided in a future PHP DSA.
    
    For reference the original advisory below :
    
    Several remote vulnerabilities have been discovered in PHP, a
    server-side, HTML-embedded scripting language. The Common
    Vulnerabilities and Exposures project identifies the following
    problems :
    
      - CVE-2007-3799
        It was discovered that the session_start() function
        allowed the insertion of attributes into the session
        cookie.
    
      - CVE-2007-3998
        Mattias Bengtsson and Philip Olausson discovered that a
        programming error in the implementation of the
        wordwrap() function allowed denial of service through an
        infinite loop.
    
      - CVE-2007-4658
        Stanislav Malyshev discovered that a format string
        vulnerability in the money_format() function could allow
        the execution of arbitrary code.
    
      - CVE-2007-4659
        Stefan Esser discovered that execution control flow
        inside the zend_alter_ini_entry() function is handled
        incorrectly in case of a memory limit violation.
    
      - CVE-2007-4660
        Gerhard Wagner discovered an integer overflow inside the
        chunk_split() function.
    
      - CVE-2007-5898
        Rasmus Lerdorf discovered that incorrect parsing of
        multibyte sequences may lead to disclosure of memory
        contents.
    
      - CVE-2007-5899
        It was discovered that the output_add_rewrite_var()
        function could leak session ID information, resulting in
        information disclosure.
    
    This update also fixes two bugs from the PHP 5.2.4 release which don't
    have security impact according to the Debian PHP security policy
    (CVE-2007-4657 and CVE-2007-4662 ), but which are fixed nonetheless."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2007-4659"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2007-3799"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2007-3998"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2007-4658"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2007-4659"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2007-4660"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2007-5898"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2007-5899"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2007-4657"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2007-4662"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2007-5898"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2007-5899"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.debian.org/security/2008/dsa-1444"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "Upgrade the php5 packages.
    
    The old stable distribution (sarge) doesn't contain php5.
    
    For the stable distribution (etch), these problems have been fixed in
    version 5.2.0-8+etch10."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_cwe_id(20, 119, 189, 200, 399);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php5");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:4.0");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2007/07/16");
      script_set_attribute(attribute:"patch_publication_date", value:"2008/01/23");
      script_set_attribute(attribute:"plugin_publication_date", value:"2008/01/04");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Debian Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("debian_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
    if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (deb_check(release:"4.0", prefix:"libapache-mod-php5", reference:"5.2.0-8+etch10")) flag++;
    if (deb_check(release:"4.0", prefix:"libapache2-mod-php5", reference:"5.2.0-8+etch10")) flag++;
    if (deb_check(release:"4.0", prefix:"php-pear", reference:"5.2.0-8+etch10")) flag++;
    if (deb_check(release:"4.0", prefix:"php5", reference:"5.2.0-8+etch10")) flag++;
    if (deb_check(release:"4.0", prefix:"php5-cgi", reference:"5.2.0-8+etch10")) flag++;
    if (deb_check(release:"4.0", prefix:"php5-cli", reference:"5.2.0-8+etch10")) flag++;
    if (deb_check(release:"4.0", prefix:"php5-common", reference:"5.2.0-8+etch10")) flag++;
    if (deb_check(release:"4.0", prefix:"php5-curl", reference:"5.2.0-8+etch10")) flag++;
    if (deb_check(release:"4.0", prefix:"php5-dev", reference:"5.2.0-8+etch10")) flag++;
    if (deb_check(release:"4.0", prefix:"php5-gd", reference:"5.2.0-8+etch10")) flag++;
    if (deb_check(release:"4.0", prefix:"php5-imap", reference:"5.2.0-8+etch10")) flag++;
    if (deb_check(release:"4.0", prefix:"php5-interbase", reference:"5.2.0-8+etch10")) flag++;
    if (deb_check(release:"4.0", prefix:"php5-ldap", reference:"5.2.0-8+etch10")) flag++;
    if (deb_check(release:"4.0", prefix:"php5-mcrypt", reference:"5.2.0-8+etch10")) flag++;
    if (deb_check(release:"4.0", prefix:"php5-mhash", reference:"5.2.0-8+etch10")) flag++;
    if (deb_check(release:"4.0", prefix:"php5-mysql", reference:"5.2.0-8+etch10")) flag++;
    if (deb_check(release:"4.0", prefix:"php5-odbc", reference:"5.2.0-8+etch10")) flag++;
    if (deb_check(release:"4.0", prefix:"php5-pgsql", reference:"5.2.0-8+etch10")) flag++;
    if (deb_check(release:"4.0", prefix:"php5-pspell", reference:"5.2.0-8+etch10")) flag++;
    if (deb_check(release:"4.0", prefix:"php5-recode", reference:"5.2.0-8+etch10")) flag++;
    if (deb_check(release:"4.0", prefix:"php5-snmp", reference:"5.2.0-8+etch10")) flag++;
    if (deb_check(release:"4.0", prefix:"php5-sqlite", reference:"5.2.0-8+etch10")) flag++;
    if (deb_check(release:"4.0", prefix:"php5-sybase", reference:"5.2.0-8+etch10")) flag++;
    if (deb_check(release:"4.0", prefix:"php5-tidy", reference:"5.2.0-8+etch10")) flag++;
    if (deb_check(release:"4.0", prefix:"php5-xmlrpc", reference:"5.2.0-8+etch10")) flag++;
    if (deb_check(release:"4.0", prefix:"php5-xsl", reference:"5.2.0-8+etch10")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_71D903FC602D11DC898C001921AB2FA4.NASL
    descriptionThe PHP development team reports : Security Enhancements and Fixes in PHP 5.2.4 : - Fixed a floating point exception inside wordwrap() (Reported by Mattias Bengtsson) - Fixed several integer overflows inside the GD extension (Reported by Mattias Bengtsson) - Fixed size calculation in chunk_split() (Reported by Gerhard Wagner) - Fixed integer overflow in str[c]spn(). (Reported by Mattias Bengtsson) - Fixed money_format() not to accept multiple %i or %n tokens. (Reported by Stanislav Malyshev) - Fixed zend_alter_ini_entry() memory_limit interruption vulnerability. (Reported by Stefan Esser) - Fixed INFILE LOCAL option handling with MySQL extensions not to be allowed when open_basedir or safe_mode is active. (Reported by Mattias Bengtsson) - Fixed session.save_path and error_log values to be checked against open_basedir and safe_mode (CVE-2007-3378) (Reported by Maksymilian Arciemowicz) - Fixed a possible invalid read in glob() win32 implementation (CVE-2007-3806) (Reported by shinnai) - Fixed a possible buffer overflow in php_openssl_make_REQ (Reported by zatanzlatan at hotbrev dot com) - Fixed an open_basedir bypass inside glob() function (Reported by dr at peytz dot dk) - Fixed a possible open_basedir bypass inside session extension when the session file is a symlink (Reported by c dot i dot morris at durham dot ac dot uk) - Improved fix for MOPB-03-2007. - Corrected fix for CVE-2007-2872.
    last seen2020-06-01
    modified2020-06-02
    plugin id26038
    published2007-09-14
    reporterThis script is Copyright (C) 2007-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/26038
    titleFreeBSD : php -- multiple vulnerabilities (71d903fc-602d-11dc-898c-001921ab2fa4)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from the FreeBSD VuXML database :
    #
    # Copyright 2003-2018 Jacques Vidrine and contributors
    #
    # Redistribution and use in source (VuXML) and 'compiled' forms (SGML,
    # HTML, PDF, PostScript, RTF and so forth) with or without modification,
    # are permitted provided that the following conditions are met:
    # 1. Redistributions of source code (VuXML) must retain the above
    #    copyright notice, this list of conditions and the following
    #    disclaimer as the first lines of this file unmodified.
    # 2. Redistributions in compiled form (transformed to other DTDs,
    #    published online in any format, converted to PDF, PostScript,
    #    RTF and other formats) must reproduce the above copyright
    #    notice, this list of conditions and the following disclaimer
    #    in the documentation and/or other materials provided with the
    #    distribution.
    # 
    # THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS"
    # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
    # THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
    # PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS
    # BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
    # OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
    # OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
    # BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
    # WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
    # OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,
    # EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(26038);
      script_version("1.18");
      script_cvs_date("Date: 2019/08/02 13:32:39");
    
      script_cve_id("CVE-2007-2872", "CVE-2007-3378", "CVE-2007-3806", "CVE-2007-3996", "CVE-2007-3997", "CVE-2007-3998", "CVE-2007-4652", "CVE-2007-4657", "CVE-2007-4658", "CVE-2007-4659", "CVE-2007-4660", "CVE-2007-4661", "CVE-2007-4662", "CVE-2007-4663", "CVE-2007-4670");
      script_xref(name:"Secunia", value:"26642");
    
      script_name(english:"FreeBSD : php -- multiple vulnerabilities (71d903fc-602d-11dc-898c-001921ab2fa4)");
      script_summary(english:"Checks for updated packages in pkg_info output");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote FreeBSD host is missing one or more security-related
    updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "The PHP development team reports :
    
    Security Enhancements and Fixes in PHP 5.2.4 :
    
    - Fixed a floating point exception inside wordwrap() (Reported by
    Mattias Bengtsson)
    
    - Fixed several integer overflows inside the GD extension (Reported by
    Mattias Bengtsson)
    
    - Fixed size calculation in chunk_split() (Reported by Gerhard Wagner)
    
    - Fixed integer overflow in str[c]spn(). (Reported by Mattias
    Bengtsson)
    
    - Fixed money_format() not to accept multiple %i or %n tokens.
    (Reported by Stanislav Malyshev)
    
    - Fixed zend_alter_ini_entry() memory_limit interruption
    vulnerability. (Reported by Stefan Esser)
    
    - Fixed INFILE LOCAL option handling with MySQL extensions not to be
    allowed when open_basedir or safe_mode is active. (Reported by Mattias
    Bengtsson)
    
    - Fixed session.save_path and error_log values to be checked against
    open_basedir and safe_mode (CVE-2007-3378) (Reported by Maksymilian
    Arciemowicz)
    
    - Fixed a possible invalid read in glob() win32 implementation
    (CVE-2007-3806) (Reported by shinnai)
    
    - Fixed a possible buffer overflow in php_openssl_make_REQ (Reported
    by zatanzlatan at hotbrev dot com)
    
    - Fixed an open_basedir bypass inside glob() function (Reported by dr
    at peytz dot dk)
    
    - Fixed a possible open_basedir bypass inside session extension when
    the session file is a symlink (Reported by c dot i dot morris at
    durham dot ac dot uk)
    
    - Improved fix for MOPB-03-2007.
    
    - Corrected fix for CVE-2007-2872."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.php.net/releases/4_4_8.php"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.php.net/releases/5_2_4.php"
      );
      # https://vuxml.freebsd.org/freebsd/71d903fc-602d-11dc-898c-001921ab2fa4.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?faf67901"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_cwe_id(20, 22, 119, 189, 264, 362, 399);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:php4");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:php5");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:freebsd:freebsd");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2007/08/30");
      script_set_attribute(attribute:"patch_publication_date", value:"2007/09/11");
      script_set_attribute(attribute:"plugin_publication_date", value:"2007/09/14");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2007-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"FreeBSD Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/FreeBSD/release", "Host/FreeBSD/pkg_info");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("freebsd_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/FreeBSD/release")) audit(AUDIT_OS_NOT, "FreeBSD");
    if (!get_kb_item("Host/FreeBSD/pkg_info")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    
    if (pkg_test(save_report:TRUE, pkg:"php5<5.2.4")) flag++;
    if (pkg_test(save_report:TRUE, pkg:"php4<4.4.8")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:pkg_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyMandriva Local Security Checks
    NASL idMANDRIVA_MDVSA-2008-126.NASL
    descriptionA number of vulnerabilities have been found and corrected in PHP : PHP 5.2.1 would allow context-dependent attackers to read portions of heap memory by executing certain scripts with a serialized data input string beginning with
    last seen2020-06-01
    modified2020-06-02
    plugin id37584
    published2009-04-23
    reporterThis script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/37584
    titleMandriva Linux Security Advisory : php (MDVSA-2008:126)
    code
    #%NASL_MIN_LEVEL 80502
    
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Mandriva Linux Security Advisory MDVSA-2008:126. 
    # The text itself is copyright (C) Mandriva S.A.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(37584);
      script_version ("1.21");
      script_cvs_date("Date: 2019/08/02 13:32:50");
    
      script_cve_id(
        "CVE-2007-1649",
        "CVE-2007-4660",
        "CVE-2007-5898",
        "CVE-2007-5899",
        "CVE-2008-2051",
        "CVE-2008-2107",
        "CVE-2008-2108",
        "CVE-2008-2829"
      );
      script_bugtraq_id(
        23105,
        25498,
        26403,
        29829
      );
      script_xref(name:"MDVSA", value:"2008:126");
    
      script_name(english:"Mandriva Linux Security Advisory : php (MDVSA-2008:126)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Mandriva Linux host is missing one or more security
    updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "A number of vulnerabilities have been found and corrected in PHP :
    
    PHP 5.2.1 would allow context-dependent attackers to read portions of
    heap memory by executing certain scripts with a serialized data input
    string beginning with 'S:', which did not properly track the number of
    input bytes being processed (CVE-2007-1649).
    
    A vulnerability in the chunk_split() function in PHP prior to 5.2.4
    has unknown impact and attack vectors, related to an incorrect size
    calculation (CVE-2007-4660).
    
    The htmlentities() and htmlspecialchars() functions in PHP prior to
    5.2.5 accepted partial multibyte sequences, which has unknown impact
    and attack vectors (CVE-2007-5898).
    
    The output_add_rewrite_var() function in PHP prior to 5.2.5 rewrites
    local forms in which the ACTION attribute references a non-local URL,
    which could allow a remote attacker to obtain potentially sensitive
    information by reading the requests for this URL (CVE-2007-5899).
    
    The escapeshellcmd() API function in PHP prior to 5.2.6 has unknown
    impact and context-dependent attack vectors related to incomplete
    multibyte characters (CVE-2008-2051).
    
    Weaknesses in the GENERATE_SEED macro in PHP prior to 4.4.8 and 5.2.5
    were discovered that could produce a zero seed in rare circumstances
    on 32bit systems and generations a portion of zero bits during
    conversion due to insufficient precision on 64bit systems
    (CVE-2008-2107, CVE-2008-2108).
    
    The IMAP module in PHP uses obsolete API calls that allow
    context-dependent attackers to cause a denial of service (crash) via a
    long IMAP request (CVE-2008-2829).
    
    The updated packages have been patched to correct these issues."
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_cwe_id(119, 189, 200, 399);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:lib64php5_common5");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:libphp5_common5");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:php-cgi");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:php-cli");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:php-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:php-fcgi");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:php-imap");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:php-openssl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:php-zlib");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:mandriva:linux:2007.1");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2008/07/03");
      script_set_attribute(attribute:"plugin_publication_date", value:"2009/04/23");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2009-2019 Tenable Network Security, Inc.");
      script_family(english:"Mandriva Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/Mandrake/release", "Host/Mandrake/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Mandrake/release")) audit(AUDIT_OS_NOT, "Mandriva / Mandake Linux");
    if (!get_kb_item("Host/Mandrake/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu !~ "^(amd64|i[3-6]86|x86_64)$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Mandriva / Mandrake Linux", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"MDK2007.1", cpu:"x86_64", reference:"lib64php5_common5-5.2.1-4.4mdv2007.1", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2007.1", cpu:"i386", reference:"libphp5_common5-5.2.1-4.4mdv2007.1", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2007.1", reference:"php-cgi-5.2.1-4.4mdv2007.1", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2007.1", reference:"php-cli-5.2.1-4.4mdv2007.1", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2007.1", reference:"php-devel-5.2.1-4.4mdv2007.1", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2007.1", reference:"php-fcgi-5.2.1-4.4mdv2007.1", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2007.1", reference:"php-imap-5.2.1-1.1mdv2007.1", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2007.1", reference:"php-openssl-5.2.1-4.4mdv2007.1", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2007.1", reference:"php-zlib-5.2.1-4.4mdv2007.1", yank:"mdv")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-549-2.NASL
    descriptionUSN-549-1 fixed vulnerabilities in PHP. However, some upstream changes were incomplete, which caused crashes in certain situations with Ubuntu 7.10. This update fixes the problem. We apologize for the inconvenience. It was discovered that the wordwrap function did not correctly check lengths. Remote attackers could exploit this to cause a crash or monopolize CPU resources, resulting in a denial of service. (CVE-2007-3998) Integer overflows were discovered in the strspn and strcspn functions. Attackers could exploit this to read arbitrary areas of memory, possibly gaining access to sensitive information. (CVE-2007-4657) Stanislav Malyshev discovered that money_format function did not correctly handle certain tokens. If a PHP application were tricked into processing a bad format string, a remote attacker could execute arbitrary code with application privileges. (CVE-2007-4658) It was discovered that the php_openssl_make_REQ function did not correctly check buffer lengths. A remote attacker could send a specially crafted message and execute arbitrary code with application privileges. (CVE-2007-4662) It was discovered that certain characters in session cookies were not handled correctly. A remote attacker could injection values which could lead to altered application behavior, potentially gaining additional privileges. (CVE-2007-3799) Gerhard Wagner discovered that the chunk_split function did not correctly handle long strings. A remote attacker could exploit this to execute arbitrary code with application privileges. (CVE-2007-2872, CVE-2007-4660, CVE-2007-4661) Stefan Esser discovered that deeply nested arrays could be made to fill stack space. A remote attacker could exploit this to cause a crash or monopolize CPU resources, resulting in a denial of service. (CVE-2007-1285, CVE-2007-4670) Rasmus Lerdorf discovered that the htmlentities and htmlspecialchars functions did not correctly stop when handling partial multibyte sequences. A remote attacker could exploit this to read certain areas of memory, possibly gaining access to sensitive information. (CVE-2007-5898) It was discovered that the output_add_rewrite_var fucntion would sometimes leak session id information to forms targeting remote URLs. Malicious remote sites could use this information to gain access to a PHP application user
    last seen2020-06-01
    modified2020-06-02
    plugin id29213
    published2007-12-04
    reporterUbuntu Security Notice (C) 2007-2019 Canonical, Inc. / NASL script (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/29213
    titleUbuntu 7.10 : php5 regression (USN-549-2)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Ubuntu Security Notice USN-549-2. The text 
    # itself is copyright (C) Canonical, Inc. See 
    # <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered 
    # trademark of Canonical, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(29213);
      script_version("1.19");
      script_cvs_date("Date: 2019/08/02 13:33:01");
    
      script_cve_id("CVE-2007-1285", "CVE-2007-2872", "CVE-2007-3799", "CVE-2007-3998", "CVE-2007-4657", "CVE-2007-4658", "CVE-2007-4660", "CVE-2007-4661", "CVE-2007-4662", "CVE-2007-4670", "CVE-2007-5898", "CVE-2007-5899");
      script_bugtraq_id(22764, 24261, 24268, 25498, 26403);
      script_xref(name:"USN", value:"549-2");
    
      script_name(english:"Ubuntu 7.10 : php5 regression (USN-549-2)");
      script_summary(english:"Checks dpkg output for updated packages.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Ubuntu host is missing one or more security-related
    patches."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "USN-549-1 fixed vulnerabilities in PHP. However, some upstream changes
    were incomplete, which caused crashes in certain situations with
    Ubuntu 7.10. This update fixes the problem.
    
    We apologize for the inconvenience.
    
    It was discovered that the wordwrap function did not correctly check
    lengths. Remote attackers could exploit this to cause a crash or
    monopolize CPU resources, resulting in a denial of service.
    (CVE-2007-3998)
    
    Integer overflows were discovered in the strspn and strcspn
    functions. Attackers could exploit this to read arbitrary
    areas of memory, possibly gaining access to sensitive
    information. (CVE-2007-4657)
    
    Stanislav Malyshev discovered that money_format function did
    not correctly handle certain tokens. If a PHP application
    were tricked into processing a bad format string, a remote
    attacker could execute arbitrary code with application
    privileges. (CVE-2007-4658)
    
    It was discovered that the php_openssl_make_REQ function did
    not correctly check buffer lengths. A remote attacker could
    send a specially crafted message and execute arbitrary code
    with application privileges. (CVE-2007-4662)
    
    It was discovered that certain characters in session cookies
    were not handled correctly. A remote attacker could
    injection values which could lead to altered application
    behavior, potentially gaining additional privileges.
    (CVE-2007-3799)
    
    Gerhard Wagner discovered that the chunk_split function did
    not correctly handle long strings. A remote attacker could
    exploit this to execute arbitrary code with application
    privileges. (CVE-2007-2872, CVE-2007-4660, CVE-2007-4661)
    
    Stefan Esser discovered that deeply nested arrays could be
    made to fill stack space. A remote attacker could exploit
    this to cause a crash or monopolize CPU resources, resulting
    in a denial of service. (CVE-2007-1285, CVE-2007-4670)
    
    Rasmus Lerdorf discovered that the htmlentities and
    htmlspecialchars functions did not correctly stop when
    handling partial multibyte sequences. A remote attacker
    could exploit this to read certain areas of memory, possibly
    gaining access to sensitive information. (CVE-2007-5898)
    
    It was discovered that the output_add_rewrite_var fucntion
    would sometimes leak session id information to forms
    targeting remote URLs. Malicious remote sites could use this
    information to gain access to a PHP application user's login
    credentials. (CVE-2007-5899).
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Ubuntu security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://usn.ubuntu.com/549-2/"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_cwe_id(20, 119, 189, 200, 399);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libapache2-mod-php5");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php-pear");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-cgi");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-cli");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-common");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-curl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-dev");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-gd");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-ldap");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-mhash");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-mysql");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-odbc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-pgsql");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-pspell");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-recode");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-snmp");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-sqlite");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-sybase");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-tidy");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-xmlrpc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-xsl");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:7.10");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2007/12/03");
      script_set_attribute(attribute:"plugin_publication_date", value:"2007/12/04");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"Ubuntu Security Notice (C) 2007-2019 Canonical, Inc. / NASL script (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Ubuntu Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("ubuntu.inc");
    include("misc_func.inc");
    
    if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/Ubuntu/release");
    if ( isnull(release) ) audit(AUDIT_OS_NOT, "Ubuntu");
    release = chomp(release);
    if (! ereg(pattern:"^(7\.10)$", string:release)) audit(AUDIT_OS_NOT, "Ubuntu 7.10", "Ubuntu " + release);
    if ( ! get_kb_item("Host/Debian/dpkg-l") ) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Ubuntu", cpu);
    
    flag = 0;
    
    if (ubuntu_check(osver:"7.10", pkgname:"libapache2-mod-php5", pkgver:"5.2.3-1ubuntu6.2")) flag++;
    if (ubuntu_check(osver:"7.10", pkgname:"php-pear", pkgver:"5.2.3-1ubuntu6.2")) flag++;
    if (ubuntu_check(osver:"7.10", pkgname:"php5", pkgver:"5.2.3-1ubuntu6.2")) flag++;
    if (ubuntu_check(osver:"7.10", pkgname:"php5-cgi", pkgver:"5.2.3-1ubuntu6.2")) flag++;
    if (ubuntu_check(osver:"7.10", pkgname:"php5-cli", pkgver:"5.2.3-1ubuntu6.2")) flag++;
    if (ubuntu_check(osver:"7.10", pkgname:"php5-common", pkgver:"5.2.3-1ubuntu6.2")) flag++;
    if (ubuntu_check(osver:"7.10", pkgname:"php5-curl", pkgver:"5.2.3-1ubuntu6.2")) flag++;
    if (ubuntu_check(osver:"7.10", pkgname:"php5-dev", pkgver:"5.2.3-1ubuntu6.2")) flag++;
    if (ubuntu_check(osver:"7.10", pkgname:"php5-gd", pkgver:"5.2.3-1ubuntu6.2")) flag++;
    if (ubuntu_check(osver:"7.10", pkgname:"php5-ldap", pkgver:"5.2.3-1ubuntu6.2")) flag++;
    if (ubuntu_check(osver:"7.10", pkgname:"php5-mhash", pkgver:"5.2.3-1ubuntu6.2")) flag++;
    if (ubuntu_check(osver:"7.10", pkgname:"php5-mysql", pkgver:"5.2.3-1ubuntu6.2")) flag++;
    if (ubuntu_check(osver:"7.10", pkgname:"php5-odbc", pkgver:"5.2.3-1ubuntu6.2")) flag++;
    if (ubuntu_check(osver:"7.10", pkgname:"php5-pgsql", pkgver:"5.2.3-1ubuntu6.2")) flag++;
    if (ubuntu_check(osver:"7.10", pkgname:"php5-pspell", pkgver:"5.2.3-1ubuntu6.2")) flag++;
    if (ubuntu_check(osver:"7.10", pkgname:"php5-recode", pkgver:"5.2.3-1ubuntu6.2")) flag++;
    if (ubuntu_check(osver:"7.10", pkgname:"php5-snmp", pkgver:"5.2.3-1ubuntu6.2")) flag++;
    if (ubuntu_check(osver:"7.10", pkgname:"php5-sqlite", pkgver:"5.2.3-1ubuntu6.2")) flag++;
    if (ubuntu_check(osver:"7.10", pkgname:"php5-sybase", pkgver:"5.2.3-1ubuntu6.2")) flag++;
    if (ubuntu_check(osver:"7.10", pkgname:"php5-tidy", pkgver:"5.2.3-1ubuntu6.2")) flag++;
    if (ubuntu_check(osver:"7.10", pkgname:"php5-xmlrpc", pkgver:"5.2.3-1ubuntu6.2")) flag++;
    if (ubuntu_check(osver:"7.10", pkgname:"php5-xsl", pkgver:"5.2.3-1ubuntu6.2")) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : ubuntu_report_get()
      );
      exit(0);
    }
    else
    {
      tested = ubuntu_pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libapache2-mod-php5 / php-pear / php5 / php5-cgi / php5-cli / etc");
    }
    
  • NASL familyCGI abuses
    NASL idPHP_5_2_4.NASL
    descriptionAccording to its banner, the version of PHP installed on the remote host is older than 5.2.4. Such versions may be affected by various issues, including but not limited to several overflows.
    last seen2020-06-01
    modified2020-06-02
    plugin id25971
    published2007-09-03
    reporterThis script is Copyright (C) 2007-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/25971
    titlePHP < 5.2.4 Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(25971);
      script_version("1.20");
      script_cvs_date("Date: 2018/07/24 18:56:10");
    
      script_cve_id(
        "CVE-2007-1413",
        "CVE-2007-2872",
        "CVE-2007-3294",
        "CVE-2007-3378",
        "CVE-2007-3790",
        "CVE-2007-3799",
        "CVE-2007-3806",
        "CVE-2007-4010",
        "CVE-2007-4033",
        "CVE-2007-4255",
        "CVE-2007-4507",
        "CVE-2007-4652",
        "CVE-2007-4658",
        "CVE-2007-4659",
        "CVE-2007-4660",
        "CVE-2007-4661",
        "CVE-2007-4662",
        "CVE-2007-4663"
      );
      script_bugtraq_id(24661, 24261, 24922, 25498);
    
      script_name(english:"PHP < 5.2.4 Multiple Vulnerabilities");
      script_summary(english:"Checks version of PHP");
     
      script_set_attribute(
        attribute:"synopsis",
        value:
    "The remote web server uses a version of PHP that is affected by
    multiple flaws."
      );
      script_set_attribute(
        attribute:"description",
        value:
    "According to its banner, the version of PHP installed on the remote
    host is older than 5.2.4.  Such versions may be affected by various
    issues, including but not limited to several overflows."
      );
      script_set_attribute(attribute:"see_also", value:"http://www.php.net/releases/5_2_4.php");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to PHP version 5.2.4 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No exploit is required");
      script_set_attribute(attribute:"exploit_available", value:"false");
      script_cwe_id(20, 22, 119, 189, 362, 399);
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2007/06/01");
      script_set_attribute(attribute:"patch_publication_date", value:"2007/08/30");
      script_set_attribute(attribute:"plugin_publication_date", value:"2007/09/03");
    
      script_set_attribute(attribute:"plugin_type", value:"remote");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:php:php");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"CGI abuses");
    
      script_copyright(english:"This script is Copyright (C) 2007-2018 Tenable Network Security, Inc.");
    
      script_dependencies("php_version.nasl");
      script_require_ports("Services/www", 80);
      script_require_keys("www/PHP");
      exit(0);
    }
    
    
    include("global_settings.inc");
    include("misc_func.inc");
    include("http.inc");
    include("audit.inc");
    include("webapp_func.inc");
    
    port = get_http_port(default:80, php:TRUE);
    
    php = get_php_from_kb(
      port : port,
      exit_on_fail : TRUE
    );
    
    version = php["ver"];
    source = php["src"];
    
    backported = get_kb_item('www/php/'+port+'/'+version+'/backported');
    
    if (report_paranoia < 2 && backported)
      audit(AUDIT_BACKPORT_SERVICE, port, "PHP "+version+" install");
    
    if (version =~ "^5\.[01]\." ||
        version =~ "^5\.2\.[0-3]($|[^0-9])"
    )
    {
      if (report_verbosity > 0)
      {
        report =
          '\n  Version source     : '+source +
          '\n  Installed version  : '+version+
          '\n  Fixed version      : 5.2.4\n';
        security_warning(port:port, extra:report);
      }
      else security_warning(port);
      exit(0);
    }
    else audit(AUDIT_LISTEN_NOT_VULN, "PHP", port, version);
    
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-549-1.NASL
    descriptionIt was discovered that the wordwrap function did not correctly check lengths. Remote attackers could exploit this to cause a crash or monopolize CPU resources, resulting in a denial of service. (CVE-2007-3998) Integer overflows were discovered in the strspn and strcspn functions. Attackers could exploit this to read arbitrary areas of memory, possibly gaining access to sensitive information. (CVE-2007-4657) Stanislav Malyshev discovered that money_format function did not correctly handle certain tokens. If a PHP application were tricked into processing a bad format string, a remote attacker could execute arbitrary code with application privileges. (CVE-2007-4658) It was discovered that the php_openssl_make_REQ function did not correctly check buffer lengths. A remote attacker could send a specially crafted message and execute arbitrary code with application privileges. (CVE-2007-4662) It was discovered that certain characters in session cookies were not handled correctly. A remote attacker could injection values which could lead to altered application behavior, potentially gaining additional privileges. (CVE-2007-3799) Gerhard Wagner discovered that the chunk_split function did not correctly handle long strings. A remote attacker could exploit this to execute arbitrary code with application privileges. (CVE-2007-2872, CVE-2007-4660, CVE-2007-4661) Stefan Esser discovered that deeply nested arrays could be made to fill stack space. A remote attacker could exploit this to cause a crash or monopolize CPU resources, resulting in a denial of service. (CVE-2007-1285, CVE-2007-4670) Rasmus Lerdorf discovered that the htmlentities and htmlspecialchars functions did not correctly stop when handling partial multibyte sequences. A remote attacker could exploit this to read certain areas of memory, possibly gaining access to sensitive information. (CVE-2007-5898) It was discovered that the output_add_rewrite_var fucntion would sometimes leak session id information to forms targeting remote URLs. Malicious remote sites could use this information to gain access to a PHP application user
    last seen2020-06-01
    modified2020-06-02
    plugin id28372
    published2007-11-30
    reporterUbuntu Security Notice (C) 2007-2019 Canonical, Inc. / NASL script (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/28372
    titleUbuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : php5 vulnerabilities (USN-549-1)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Ubuntu Security Notice USN-549-1. The text 
    # itself is copyright (C) Canonical, Inc. See 
    # <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered 
    # trademark of Canonical, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(28372);
      script_version("1.19");
      script_cvs_date("Date: 2019/08/02 13:33:01");
    
      script_cve_id("CVE-2007-1285", "CVE-2007-2872", "CVE-2007-3799", "CVE-2007-3998", "CVE-2007-4657", "CVE-2007-4658", "CVE-2007-4660", "CVE-2007-4661", "CVE-2007-4662", "CVE-2007-4670", "CVE-2007-5898", "CVE-2007-5899");
      script_bugtraq_id(22764, 24261, 24268, 25498, 26403);
      script_xref(name:"USN", value:"549-1");
    
      script_name(english:"Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : php5 vulnerabilities (USN-549-1)");
      script_summary(english:"Checks dpkg output for updated packages.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Ubuntu host is missing one or more security-related
    patches."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "It was discovered that the wordwrap function did not correctly check
    lengths. Remote attackers could exploit this to cause a crash or
    monopolize CPU resources, resulting in a denial of service.
    (CVE-2007-3998)
    
    Integer overflows were discovered in the strspn and strcspn functions.
    Attackers could exploit this to read arbitrary areas of memory,
    possibly gaining access to sensitive information. (CVE-2007-4657)
    
    Stanislav Malyshev discovered that money_format function did not
    correctly handle certain tokens. If a PHP application were tricked
    into processing a bad format string, a remote attacker could execute
    arbitrary code with application privileges. (CVE-2007-4658)
    
    It was discovered that the php_openssl_make_REQ function did not
    correctly check buffer lengths. A remote attacker could send a
    specially crafted message and execute arbitrary code with application
    privileges. (CVE-2007-4662)
    
    It was discovered that certain characters in session cookies were not
    handled correctly. A remote attacker could injection values which
    could lead to altered application behavior, potentially gaining
    additional privileges. (CVE-2007-3799)
    
    Gerhard Wagner discovered that the chunk_split function did not
    correctly handle long strings. A remote attacker could exploit this to
    execute arbitrary code with application privileges. (CVE-2007-2872,
    CVE-2007-4660, CVE-2007-4661)
    
    Stefan Esser discovered that deeply nested arrays could be made to
    fill stack space. A remote attacker could exploit this to cause a
    crash or monopolize CPU resources, resulting in a denial of service.
    (CVE-2007-1285, CVE-2007-4670)
    
    Rasmus Lerdorf discovered that the htmlentities and htmlspecialchars
    functions did not correctly stop when handling partial multibyte
    sequences. A remote attacker could exploit this to read certain areas
    of memory, possibly gaining access to sensitive information.
    (CVE-2007-5898)
    
    It was discovered that the output_add_rewrite_var fucntion would
    sometimes leak session id information to forms targeting remote URLs.
    Malicious remote sites could use this information to gain access to a
    PHP application user's login credentials. (CVE-2007-5899).
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Ubuntu security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://usn.ubuntu.com/549-1/"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_cwe_id(20, 119, 189, 200, 399);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libapache2-mod-php5");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php-pear");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-cgi");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-cli");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-common");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-curl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-dev");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-gd");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-ldap");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-mhash");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-mysql");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-mysqli");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-odbc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-pgsql");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-pspell");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-recode");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-snmp");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-sqlite");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-sybase");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-tidy");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-xmlrpc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-xsl");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:6.06:-:lts");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:6.10");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:7.04");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:7.10");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2007/11/29");
      script_set_attribute(attribute:"plugin_publication_date", value:"2007/11/30");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"Ubuntu Security Notice (C) 2007-2019 Canonical, Inc. / NASL script (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Ubuntu Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("ubuntu.inc");
    include("misc_func.inc");
    
    if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/Ubuntu/release");
    if ( isnull(release) ) audit(AUDIT_OS_NOT, "Ubuntu");
    release = chomp(release);
    if (! ereg(pattern:"^(6\.06|6\.10|7\.04|7\.10)$", string:release)) audit(AUDIT_OS_NOT, "Ubuntu 6.06 / 6.10 / 7.04 / 7.10", "Ubuntu " + release);
    if ( ! get_kb_item("Host/Debian/dpkg-l") ) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Ubuntu", cpu);
    
    flag = 0;
    
    if (ubuntu_check(osver:"6.06", pkgname:"libapache2-mod-php5", pkgver:"5.1.2-1ubuntu3.10")) flag++;
    if (ubuntu_check(osver:"6.06", pkgname:"php-pear", pkgver:"5.1.2-1ubuntu3.10")) flag++;
    if (ubuntu_check(osver:"6.06", pkgname:"php5", pkgver:"5.1.2-1ubuntu3.10")) flag++;
    if (ubuntu_check(osver:"6.06", pkgname:"php5-cgi", pkgver:"5.1.2-1ubuntu3.10")) flag++;
    if (ubuntu_check(osver:"6.06", pkgname:"php5-cli", pkgver:"5.1.2-1ubuntu3.10")) flag++;
    if (ubuntu_check(osver:"6.06", pkgname:"php5-common", pkgver:"5.1.2-1ubuntu3.10")) flag++;
    if (ubuntu_check(osver:"6.06", pkgname:"php5-curl", pkgver:"5.1.2-1ubuntu3.10")) flag++;
    if (ubuntu_check(osver:"6.06", pkgname:"php5-dev", pkgver:"5.1.2-1ubuntu3.10")) flag++;
    if (ubuntu_check(osver:"6.06", pkgname:"php5-gd", pkgver:"5.1.2-1ubuntu3.10")) flag++;
    if (ubuntu_check(osver:"6.06", pkgname:"php5-ldap", pkgver:"5.1.2-1ubuntu3.10")) flag++;
    if (ubuntu_check(osver:"6.06", pkgname:"php5-mhash", pkgver:"5.1.2-1ubuntu3.10")) flag++;
    if (ubuntu_check(osver:"6.06", pkgname:"php5-mysql", pkgver:"5.1.2-1ubuntu3.10")) flag++;
    if (ubuntu_check(osver:"6.06", pkgname:"php5-mysqli", pkgver:"5.1.2-1ubuntu3.10")) flag++;
    if (ubuntu_check(osver:"6.06", pkgname:"php5-odbc", pkgver:"5.1.2-1ubuntu3.10")) flag++;
    if (ubuntu_check(osver:"6.06", pkgname:"php5-pgsql", pkgver:"5.1.2-1ubuntu3.10")) flag++;
    if (ubuntu_check(osver:"6.06", pkgname:"php5-recode", pkgver:"5.1.2-1ubuntu3.10")) flag++;
    if (ubuntu_check(osver:"6.06", pkgname:"php5-snmp", pkgver:"5.1.2-1ubuntu3.10")) flag++;
    if (ubuntu_check(osver:"6.06", pkgname:"php5-sqlite", pkgver:"5.1.2-1ubuntu3.10")) flag++;
    if (ubuntu_check(osver:"6.06", pkgname:"php5-sybase", pkgver:"5.1.2-1ubuntu3.10")) flag++;
    if (ubuntu_check(osver:"6.06", pkgname:"php5-xmlrpc", pkgver:"5.1.2-1ubuntu3.10")) flag++;
    if (ubuntu_check(osver:"6.06", pkgname:"php5-xsl", pkgver:"5.1.2-1ubuntu3.10")) flag++;
    if (ubuntu_check(osver:"6.10", pkgname:"libapache2-mod-php5", pkgver:"5.1.6-1ubuntu2.7")) flag++;
    if (ubuntu_check(osver:"6.10", pkgname:"php-pear", pkgver:"5.1.6-1ubuntu2.7")) flag++;
    if (ubuntu_check(osver:"6.10", pkgname:"php5", pkgver:"5.1.6-1ubuntu2.7")) flag++;
    if (ubuntu_check(osver:"6.10", pkgname:"php5-cgi", pkgver:"5.1.6-1ubuntu2.7")) flag++;
    if (ubuntu_check(osver:"6.10", pkgname:"php5-cli", pkgver:"5.1.6-1ubuntu2.7")) flag++;
    if (ubuntu_check(osver:"6.10", pkgname:"php5-common", pkgver:"5.1.6-1ubuntu2.7")) flag++;
    if (ubuntu_check(osver:"6.10", pkgname:"php5-curl", pkgver:"5.1.6-1ubuntu2.7")) flag++;
    if (ubuntu_check(osver:"6.10", pkgname:"php5-dev", pkgver:"5.1.6-1ubuntu2.7")) flag++;
    if (ubuntu_check(osver:"6.10", pkgname:"php5-gd", pkgver:"5.1.6-1ubuntu2.7")) flag++;
    if (ubuntu_check(osver:"6.10", pkgname:"php5-ldap", pkgver:"5.1.6-1ubuntu2.7")) flag++;
    if (ubuntu_check(osver:"6.10", pkgname:"php5-mhash", pkgver:"5.1.6-1ubuntu2.7")) flag++;
    if (ubuntu_check(osver:"6.10", pkgname:"php5-mysql", pkgver:"5.1.6-1ubuntu2.7")) flag++;
    if (ubuntu_check(osver:"6.10", pkgname:"php5-mysqli", pkgver:"5.1.6-1ubuntu2.7")) flag++;
    if (ubuntu_check(osver:"6.10", pkgname:"php5-odbc", pkgver:"5.1.6-1ubuntu2.7")) flag++;
    if (ubuntu_check(osver:"6.10", pkgname:"php5-pgsql", pkgver:"5.1.6-1ubuntu2.7")) flag++;
    if (ubuntu_check(osver:"6.10", pkgname:"php5-recode", pkgver:"5.1.6-1ubuntu2.7")) flag++;
    if (ubuntu_check(osver:"6.10", pkgname:"php5-snmp", pkgver:"5.1.6-1ubuntu2.7")) flag++;
    if (ubuntu_check(osver:"6.10", pkgname:"php5-sqlite", pkgver:"5.1.6-1ubuntu2.7")) flag++;
    if (ubuntu_check(osver:"6.10", pkgname:"php5-sybase", pkgver:"5.1.6-1ubuntu2.7")) flag++;
    if (ubuntu_check(osver:"6.10", pkgname:"php5-xmlrpc", pkgver:"5.1.6-1ubuntu2.7")) flag++;
    if (ubuntu_check(osver:"6.10", pkgname:"php5-xsl", pkgver:"5.1.6-1ubuntu2.7")) flag++;
    if (ubuntu_check(osver:"7.04", pkgname:"libapache2-mod-php5", pkgver:"5.2.1-0ubuntu1.5")) flag++;
    if (ubuntu_check(osver:"7.04", pkgname:"php-pear", pkgver:"5.2.1-0ubuntu1.5")) flag++;
    if (ubuntu_check(osver:"7.04", pkgname:"php5", pkgver:"5.2.1-0ubuntu1.5")) flag++;
    if (ubuntu_check(osver:"7.04", pkgname:"php5-cgi", pkgver:"5.2.1-0ubuntu1.5")) flag++;
    if (ubuntu_check(osver:"7.04", pkgname:"php5-cli", pkgver:"5.2.1-0ubuntu1.5")) flag++;
    if (ubuntu_check(osver:"7.04", pkgname:"php5-common", pkgver:"5.2.1-0ubuntu1.5")) flag++;
    if (ubuntu_check(osver:"7.04", pkgname:"php5-curl", pkgver:"5.2.1-0ubuntu1.5")) flag++;
    if (ubuntu_check(osver:"7.04", pkgname:"php5-dev", pkgver:"5.2.1-0ubuntu1.5")) flag++;
    if (ubuntu_check(osver:"7.04", pkgname:"php5-gd", pkgver:"5.2.1-0ubuntu1.5")) flag++;
    if (ubuntu_check(osver:"7.04", pkgname:"php5-ldap", pkgver:"5.2.1-0ubuntu1.5")) flag++;
    if (ubuntu_check(osver:"7.04", pkgname:"php5-mhash", pkgver:"5.2.1-0ubuntu1.5")) flag++;
    if (ubuntu_check(osver:"7.04", pkgname:"php5-mysql", pkgver:"5.2.1-0ubuntu1.5")) flag++;
    if (ubuntu_check(osver:"7.04", pkgname:"php5-odbc", pkgver:"5.2.1-0ubuntu1.5")) flag++;
    if (ubuntu_check(osver:"7.04", pkgname:"php5-pgsql", pkgver:"5.2.1-0ubuntu1.5")) flag++;
    if (ubuntu_check(osver:"7.04", pkgname:"php5-pspell", pkgver:"5.2.1-0ubuntu1.5")) flag++;
    if (ubuntu_check(osver:"7.04", pkgname:"php5-recode", pkgver:"5.2.1-0ubuntu1.5")) flag++;
    if (ubuntu_check(osver:"7.04", pkgname:"php5-snmp", pkgver:"5.2.1-0ubuntu1.5")) flag++;
    if (ubuntu_check(osver:"7.04", pkgname:"php5-sqlite", pkgver:"5.2.1-0ubuntu1.5")) flag++;
    if (ubuntu_check(osver:"7.04", pkgname:"php5-sybase", pkgver:"5.2.1-0ubuntu1.5")) flag++;
    if (ubuntu_check(osver:"7.04", pkgname:"php5-tidy", pkgver:"5.2.1-0ubuntu1.5")) flag++;
    if (ubuntu_check(osver:"7.04", pkgname:"php5-xmlrpc", pkgver:"5.2.1-0ubuntu1.5")) flag++;
    if (ubuntu_check(osver:"7.04", pkgname:"php5-xsl", pkgver:"5.2.1-0ubuntu1.5")) flag++;
    if (ubuntu_check(osver:"7.10", pkgname:"libapache2-mod-php5", pkgver:"5.2.3-1ubuntu6.1")) flag++;
    if (ubuntu_check(osver:"7.10", pkgname:"php-pear", pkgver:"5.2.3-1ubuntu6.1")) flag++;
    if (ubuntu_check(osver:"7.10", pkgname:"php5", pkgver:"5.2.3-1ubuntu6.1")) flag++;
    if (ubuntu_check(osver:"7.10", pkgname:"php5-cgi", pkgver:"5.2.3-1ubuntu6.1")) flag++;
    if (ubuntu_check(osver:"7.10", pkgname:"php5-cli", pkgver:"5.2.3-1ubuntu6.1")) flag++;
    if (ubuntu_check(osver:"7.10", pkgname:"php5-common", pkgver:"5.2.3-1ubuntu6.1")) flag++;
    if (ubuntu_check(osver:"7.10", pkgname:"php5-curl", pkgver:"5.2.3-1ubuntu6.1")) flag++;
    if (ubuntu_check(osver:"7.10", pkgname:"php5-dev", pkgver:"5.2.3-1ubuntu6.1")) flag++;
    if (ubuntu_check(osver:"7.10", pkgname:"php5-gd", pkgver:"5.2.3-1ubuntu6.1")) flag++;
    if (ubuntu_check(osver:"7.10", pkgname:"php5-ldap", pkgver:"5.2.3-1ubuntu6.1")) flag++;
    if (ubuntu_check(osver:"7.10", pkgname:"php5-mhash", pkgver:"5.2.3-1ubuntu6.1")) flag++;
    if (ubuntu_check(osver:"7.10", pkgname:"php5-mysql", pkgver:"5.2.3-1ubuntu6.1")) flag++;
    if (ubuntu_check(osver:"7.10", pkgname:"php5-odbc", pkgver:"5.2.3-1ubuntu6.1")) flag++;
    if (ubuntu_check(osver:"7.10", pkgname:"php5-pgsql", pkgver:"5.2.3-1ubuntu6.1")) flag++;
    if (ubuntu_check(osver:"7.10", pkgname:"php5-pspell", pkgver:"5.2.3-1ubuntu6.1")) flag++;
    if (ubuntu_check(osver:"7.10", pkgname:"php5-recode", pkgver:"5.2.3-1ubuntu6.1")) flag++;
    if (ubuntu_check(osver:"7.10", pkgname:"php5-snmp", pkgver:"5.2.3-1ubuntu6.1")) flag++;
    if (ubuntu_check(osver:"7.10", pkgname:"php5-sqlite", pkgver:"5.2.3-1ubuntu6.1")) flag++;
    if (ubuntu_check(osver:"7.10", pkgname:"php5-sybase", pkgver:"5.2.3-1ubuntu6.1")) flag++;
    if (ubuntu_check(osver:"7.10", pkgname:"php5-tidy", pkgver:"5.2.3-1ubuntu6.1")) flag++;
    if (ubuntu_check(osver:"7.10", pkgname:"php5-xmlrpc", pkgver:"5.2.3-1ubuntu6.1")) flag++;
    if (ubuntu_check(osver:"7.10", pkgname:"php5-xsl", pkgver:"5.2.3-1ubuntu6.1")) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : ubuntu_report_get()
      );
      exit(0);
    }
    else
    {
      tested = ubuntu_pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libapache2-mod-php5 / php-pear / php5 / php5-cgi / php5-cli / etc");
    }
    

Statements

contributorTomas Hoger
lastmodified2010-01-29
organizationRed Hat
statementNot vulnerable. Red Hat did not include an incomplete fix for CVE-2007-2872 for PHP in Red Hat Enterprise Linux or Red Hat Application Stack. For more details, see: https://bugzilla.redhat.com/show_bug.cgi?id=278161#c5