Vulnerabilities > CVE-2008-5814 - Cross-site Scripting vulnerability in PHP

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Red Hat Security Advisory RHSA-2009:0338 and 
# Oracle Linux Security Advisory ELSA-2009-0338 respectively.
#

include("compat.inc");

if (description)
{
  script_id(67818);
  script_version("1.12");
  script_cvs_date("Date: 2019/10/25 13:36:07");

  script_cve_id("CVE-2008-3658", "CVE-2008-3660", "CVE-2008-5498", "CVE-2008-5557", "CVE-2008-5814", "CVE-2009-0754");
  script_bugtraq_id(30649, 31612, 32948, 33002, 33542);
  script_xref(name:"RHSA", value:"2009:0338");

  script_name(english:"Oracle Linux 5 : php (ELSA-2009-0338)");
  script_summary(english:"Checks rpm output for the updated packages");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Oracle Linux host is missing one or more security updates."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"From Red Hat Security Advisory 2009:0338 :

Updated php packages that fix several security issues are now
available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the
Red Hat Security Response Team.

PHP is an HTML-embedded scripting language commonly used with the
Apache HTTP Web server.

A heap-based buffer overflow flaw was found in PHP's mbstring
extension. A remote attacker able to pass arbitrary input to a PHP
script using mbstring conversion functions could cause the PHP
interpreter to crash or, possibly, execute arbitrary code.
(CVE-2008-5557)

A flaw was found in the handling of the 'mbstring.func_overload'
configuration setting. A value set for one virtual host, or in a
user's .htaccess file, was incorrectly applied to other virtual hosts
on the same server, causing the handling of multibyte character
strings to not work correctly. (CVE-2009-0754)

A buffer overflow flaw was found in PHP's imageloadfont function. If a
PHP script allowed a remote attacker to load a carefully crafted font
file, it could cause the PHP interpreter to crash or, possibly,
execute arbitrary code. (CVE-2008-3658)

A flaw was found in the way PHP handled certain file extensions when
running in FastCGI mode. If the PHP interpreter was being executed via
FastCGI, a remote attacker could create a request which would cause
the PHP interpreter to crash. (CVE-2008-3660)

A memory disclosure flaw was found in the PHP gd extension's
imagerotate function. A remote attacker able to pass arbitrary values
as the 'background color' argument of the function could, possibly,
view portions of the PHP interpreter's memory. (CVE-2008-5498)

A cross-site scripting flaw was found in a way PHP reported errors for
invalid cookies. If the PHP interpreter had 'display_errors' enabled,
a remote attacker able to set a specially crafted cookie on a victim's
system could possibly inject arbitrary HTML into an error message
generated by PHP. (CVE-2008-5814)

All php users are advised to upgrade to these updated packages, which
contain backported patches to resolve these issues. The httpd web
server must be restarted for the changes to take effect."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://oss.oracle.com/pipermail/el-errata/2009-April/000949.html"
  );
  script_set_attribute(attribute:"solution", value:"Update the affected php packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(20, 79, 119, 134, 200);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:php");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:php-bcmath");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:php-cli");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:php-common");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:php-dba");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:php-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:php-gd");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:php-imap");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:php-ldap");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:php-mbstring");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:php-mysql");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:php-ncurses");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:php-odbc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:php-pdo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:php-pgsql");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:php-snmp");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:php-soap");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:php-xml");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:php-xmlrpc");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:linux:5");

  script_set_attribute(attribute:"vuln_publication_date", value:"2008/08/14");
  script_set_attribute(attribute:"patch_publication_date", value:"2009/04/06");
  script_set_attribute(attribute:"plugin_publication_date", value:"2013/07/12");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Oracle Linux Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/OracleLinux", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/OracleLinux")) audit(AUDIT_OS_NOT, "Oracle Linux");
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || !pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux)", string:release)) audit(AUDIT_OS_NOT, "Oracle Linux");
os_ver = pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\.[0-9]+)?)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Oracle Linux");
os_ver = os_ver[1];
if (! preg(pattern:"^5([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Oracle Linux 5", "Oracle Linux " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && "ia64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Oracle Linux", cpu);

flag = 0;
if (rpm_check(release:"EL5", reference:"php-5.1.6-23.2.el5_3")) flag++;
if (rpm_check(release:"EL5", reference:"php-bcmath-5.1.6-23.2.el5_3")) flag++;
if (rpm_check(release:"EL5", reference:"php-cli-5.1.6-23.2.el5_3")) flag++;
if (rpm_check(release:"EL5", reference:"php-common-5.1.6-23.2.el5_3")) flag++;
if (rpm_check(release:"EL5", reference:"php-dba-5.1.6-23.2.el5_3")) flag++;
if (rpm_check(release:"EL5", reference:"php-devel-5.1.6-23.2.el5_3")) flag++;
if (rpm_check(release:"EL5", reference:"php-gd-5.1.6-23.2.el5_3")) flag++;
if (rpm_check(release:"EL5", reference:"php-imap-5.1.6-23.2.el5_3")) flag++;
if (rpm_check(release:"EL5", reference:"php-ldap-5.1.6-23.2.el5_3")) flag++;
if (rpm_check(release:"EL5", reference:"php-mbstring-5.1.6-23.2.el5_3")) flag++;
if (rpm_check(release:"EL5", reference:"php-mysql-5.1.6-23.2.el5_3")) flag++;
if (rpm_check(release:"EL5", reference:"php-ncurses-5.1.6-23.2.el5_3")) flag++;
if (rpm_check(release:"EL5", reference:"php-odbc-5.1.6-23.2.el5_3")) flag++;
if (rpm_check(release:"EL5", reference:"php-pdo-5.1.6-23.2.el5_3")) flag++;
if (rpm_check(release:"EL5", reference:"php-pgsql-5.1.6-23.2.el5_3")) flag++;
if (rpm_check(release:"EL5", reference:"php-snmp-5.1.6-23.2.el5_3")) flag++;
if (rpm_check(release:"EL5", reference:"php-soap-5.1.6-23.2.el5_3")) flag++;
if (rpm_check(release:"EL5", reference:"php-xml-5.1.6-23.2.el5_3")) flag++;
if (rpm_check(release:"EL5", reference:"php-xmlrpc-5.1.6-23.2.el5_3")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
  else security_hole(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "php / php-bcmath / php-cli / php-common / php-dba / php-devel / etc");
}

#
# (C) Tenable Network Security, Inc.
#


include("compat.inc");

if (description)
{
  script_id(38832);
  script_version("1.18");
  script_cvs_date("Date: 2018/06/13 18:56:27");

  script_cve_id("CVE-2008-5077", "CVE-2008-5814", "CVE-2009-1418");
  script_bugtraq_id(35031);
  script_xref(name:"Secunia", value:"35108");

  script_name(english:"HP System Management Homepage < 3.0.1.73 Multiple Flaws");
  script_summary(english:"Checks version of HP SMH");

  script_set_attribute(attribute:"synopsis", value:"The remote web server is affected by multiple vulnerabilities.");

  script_set_attribute(
    attribute:"description",
    value:
"According to its self-reported version number, the HP System
Management Homepage install on the remote host is earlier than
3.0.1.73.  Such versions are reportedly affected by multiple flaws :

  - A weakness in PHP could be exploited to perform cross-
    site scripting attacks, provided PHP directive 'display
    errors' is enabled. (CVE-2008-5814)

  - A vulnerability in OpenSSL versions prior to 0.9.8i
    could be exploited to bypass the validation of the
    certificate chain. (CVE-2008-5077)

  - Windows and Linux versions of SMH are affected by a
    cross-site scripting vulnerability. (CVE-2009-1418)"
  );
  # http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01743291
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?5252a6f9");
  # http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01745065
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?e2a507a8"
  );
  script_set_attribute(attribute:"solution", value:"Upgrade to HP System Management Homepage 3.0.1.73 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(20, 79);

  script_set_attribute(attribute:"patch_publication_date", value:"2009/05/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2009/05/20");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:hp:system_management_homepage");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2009-2018 Tenable Network Security, Inc.");

  script_dependencies("compaq_wbem_detect.nasl", "os_fingerprint.nasl");
  script_require_keys("www/hp_smh");
  script_require_ports("Services/www", 2301, 2381);

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("http.inc");
include("webapp_func.inc");


port = get_http_port(default:2381, embedded:TRUE);


install = get_install_from_kb(appname:'hp_smh', port:port, exit_on_fail:TRUE);
prod = get_kb_item_or_exit("www/"+port+"/hp_smh/variant");


# nb: HP only says Linux and Windows are affected
if (report_paranoia < 2)
{
  os = get_kb_item_or_exit("Host/OS");
  if ("Windows" >!< os && "Linux" >!< os) exit(0, "The remote host appears to be running "+os+", and only Windows and Linux installs are affected.");
}


dir = install['dir'];
version = install['ver'];
if (version == UNKNOWN_VER)
  exit(1, 'The version of '+prod+' installed at '+build_url(port:port, qs:dir+"/")+' is unknown.');

# nb: 'version' can have non-numeric characters in it so we'll create
#     an alternate form and make sure that's safe for use in 'ver_compare()'.
version_alt = ereg_replace(pattern:"[_-]", replace:".", string:version);
if (!ereg(pattern:"^[0-9][0-9.]+$", string:version_alt))
  exit(1, 'The version of '+prod+' installed at '+build_url(port:port, qs:dir+"/")+' does not look valid ('+version+').');

fixed_version = '3.0.1.73';
if (ver_compare(ver:version_alt, fix:fixed_version, strict:FALSE) == -1)
{
  set_kb_item(name:'www/'+port+'/XSS', value:TRUE);

  if (report_verbosity > 0)
  {
    source_line = get_kb_item("www/"+port+"/hp_smh/source");

    report = '\n  Product           : ' + prod;
    if (!isnull(source_line))
      report += '\n  Version source    : ' + source_line;
    report +=
      '\n  Installed version : ' + version +
      '\n  Fixed version     : ' + fixed_version + '\n';
    security_warning(port:port, extra:report);
  }
  else security_warning(port);

  exit(0);
}
else exit(0, prod+" "+version+" is listening on port "+port+" and is not affected.");

#
# (C) Tenable Network Security, Inc.
#


include("compat.inc");


if (description)
{
  script_id(46015);
  script_version("1.23");
  script_cvs_date("Date: 2018/11/15 20:50:25");

  script_cve_id(
    "CVE-2008-1468",
    "CVE-2008-4226",
    "CVE-2008-5557",
    "CVE-2008-5814",
    "CVE-2009-1377",
    "CVE-2009-1378",
    "CVE-2009-1379",
    "CVE-2009-1386",
    "CVE-2009-1387",
    "CVE-2010-1034",
    "CVE-2009-4185"
  );
  script_bugtraq_id(
    28380,
    32326,
    32948,
    35001,
    35138,
    35174,
    35417,
    38081,
    39632
  );
  script_xref(name:"Secunia", value:"38341");

  script_name(english:"HP System Management Homepage < 6.0.0.96 / 6.0.0-95 Multiple Vulnerabilities");
  script_summary(english:"Does a banner check");

  script_set_attribute(attribute:"synopsis", value:"The remote web server has multiple vulnerabilities.");
  script_set_attribute(
    attribute:"description",
    value:
"According to its self-reported version number, the HP System
Management Homepage install on the remote host is earlier than
6.0.0.96 / 6.0.0-95.  Such versions are potentially affected by the
following vulnerabilities :

  - A cross-site scripting (XSS) vulnerability due to a
    failure to sanitize UTF-7 encoded input.  Browsers are
    only affected if encoding is set to auto-select.
    (CVE-2008-1468)

  - An integer overflow in the libxml2 library that can
    result in a heap overflow. (CVE-2008-4226)

  - A buffer overflow in the PHP mbstring extension.
    (CVE-2008-5557)

  - An unspecified XSS in PHP when 'display_errors' is
    enabled. (CVE-2008-5814)

  - Multiple denial of service vulnerabilities in OpenSSL
    DTLS. (CVE-2009-1377, CVE-2009-1378, CVE-2009-1379,
    CVE-2009-1386, CVE-2009-1387)

  - A cross-site scripting vulnerability due to a failure
    to sanitize input to the 'servercert' parameter of
    '/proxy/smhu/getuiinfo'.  (CVE-2009-4185)

  - An unspecified vulnerability that could allow an
    attacker to access sensitive information, modify data,
    or cause a denial of service. (CVE-2010-1034)"
  );
  # https://web.archive.org/web/20100611001622/http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr09-15
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?857eff38"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://seclists.org/bugtraq/2010/Apr/205"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://seclists.org/bugtraq/2010/Feb/47"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?2eb58026"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?205d52bb"
  );
  script_set_attribute(
    attribute:"solution",
    value:
"Upgrade to HP System Management Homepage 6.0.0.96 (Windows) /
6.0.0-95 (Linux) or later."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploit_framework_core", value:"true");
  script_cwe_id(79, 119, 399);

  script_set_attribute(attribute:"vuln_publication_date", value:"2008/03/21");
  script_set_attribute(attribute:"patch_publication_date", value:"2009/11/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2010/04/27");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:hp:system_management_homepage");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Web Servers");

  script_copyright(english:"This script is Copyright (C) 2010-2018 Tenable Network Security, Inc.");

  script_dependencies("compaq_wbem_detect.nasl");
  script_require_keys("www/hp_smh");
  script_require_ports("Services/www", 2301, 2381);

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("http.inc");
include("webapp_func.inc");


port = get_http_port(default:2381, embedded:TRUE);


install = get_install_from_kb(appname:'hp_smh', port:port, exit_on_fail:TRUE);
dir = install['dir'];
version = install['ver'];
prod = get_kb_item_or_exit("www/"+port+"/hp_smh/variant");
if (version == UNKNOWN_VER)
  exit(1, 'The version of '+prod+' installed at '+build_url(port:port, qs:dir+"/")+' is unknown.');

# nb: 'version' can have non-numeric characters in it so we'll create
#     an alternate form and make sure that's safe for use in 'ver_compare()'.
version_alt = ereg_replace(pattern:"[_-]", replace:".", string:version);
if (!ereg(pattern:"^[0-9][0-9.]+$", string:version_alt))
  exit(1, 'The version of '+prod+' installed at '+build_url(port:port, qs:dir+"/")+' does not look valid ('+version+').');

# technically 6.0.0.95 is the fix for Linux and 6.0.0.96 is the fix for
# Windows, but there is no way to infer OS from the banner. since there
# is no 6.0.0.95 publicly released for Windows, this check should be
# Good Enough
fixed_version = '6.0.0.95';
if (ver_compare(ver:version_alt, fix:fixed_version, strict:FALSE) == -1)
{
  if (report_verbosity > 0)
  {
    source_line = get_kb_item("www/"+port+"/hp_smh/source");

    report = '\n  Product           : ' + prod;
    if (!isnull(source_line))
      report += '\n  Version source    : ' + source_line;
    report +=
      '\n  Installed version : ' + version +
      '\n  Fixed version     : 6.0.0.96 (Windows) / 6.0.0-95 (Linux)\n';
    security_hole(port:port, extra:report);
  }
  else security_hole(port);

  exit(0);
}
else exit(0, prod+" "+version+" is listening on port "+port+" and is not affected.");

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Gentoo Linux Security Advisory GLSA 201001-03.
#
# The advisory text is Copyright (C) 2001-2018 Gentoo Foundation, Inc.
# and licensed under the Creative Commons - Attribution / Share Alike 
# license. See http://creativecommons.org/licenses/by-sa/3.0/
#

include("compat.inc");

if (description)
{
  script_id(44892);
  script_version("1.17");
  script_cvs_date("Date: 2019/08/02 13:32:45");

  script_cve_id("CVE-2008-5498", "CVE-2008-5514", "CVE-2008-5557", "CVE-2008-5624", "CVE-2008-5625", "CVE-2008-5658", "CVE-2008-5814", "CVE-2008-5844", "CVE-2008-7002", "CVE-2009-0754", "CVE-2009-1271", "CVE-2009-1272", "CVE-2009-2626", "CVE-2009-2687", "CVE-2009-3291", "CVE-2009-3292", "CVE-2009-3293", "CVE-2009-3546", "CVE-2009-3557", "CVE-2009-3558", "CVE-2009-4017", "CVE-2009-4142", "CVE-2009-4143");
  script_bugtraq_id(32625, 32948, 32958, 33002, 33542, 35440, 36449, 36712, 37079, 37390);
  script_xref(name:"GLSA", value:"201001-03");

  script_name(english:"GLSA-201001-03 : PHP: Multiple vulnerabilities");
  script_summary(english:"Checks for updated package(s) in /var/db/pkg");

  script_set_attribute(
    attribute:"synopsis", 
    value:
"The remote Gentoo host is missing one or more security-related
patches."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"The remote host is affected by the vulnerability described in GLSA-201001-03
(PHP: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in PHP. Please review the
    CVE identifiers referenced below and the associated PHP release notes
    for details.
  
Impact :

    A context-dependent attacker could execute arbitrary code via a
    specially crafted string containing an HTML entity when the mbstring
    extension is enabled. Furthermore a remote attacker could execute
    arbitrary code via a specially crafted GD graphics file.
    A remote attacker could also cause a Denial of Service via a malformed
    string passed to the json_decode() function, via a specially crafted
    ZIP file passed to the php_zip_make_relative_path() function, via a
    malformed JPEG image passed to the exif_read_data() function, or via
    temporary file exhaustion. It is also possible for an attacker to spoof
    certificates, bypass various safe_mode and open_basedir restrictions
    when certain criteria are met, perform Cross-site scripting attacks,
    more easily perform SQL injection attacks, manipulate settings of other
    virtual hosts on the same server via a malicious .htaccess entry when
    running on Apache, disclose memory portions, and write arbitrary files
    via a specially crafted ZIP archive. Some vulnerabilities with unknown
    impact and attack vectors have been reported as well.
  
Workaround :

    There is no known workaround at this time."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security.gentoo.org/glsa/200911-03"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security.gentoo.org/glsa/201001-03"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"All PHP users should upgrade to the latest version. As PHP is
    statically linked against a vulnerable version of the c-client library
    when the imap or kolab USE flag is enabled (GLSA 200911-03), users
    should upgrade net-libs/c-client beforehand:
    # emerge --sync
    # emerge --ask --oneshot --verbose '>=net-libs/c-client-2007e'
    # emerge --ask --oneshot --verbose '>=dev-lang/php-5.2.12'"
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(16, 20, 22, 79, 119, 134, 200, 264);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:php");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux");

  script_set_attribute(attribute:"patch_publication_date", value:"2010/01/05");
  script_set_attribute(attribute:"plugin_publication_date", value:"2010/02/25");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Gentoo Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("qpkg.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo");
if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;

if (qpkg_check(package:"dev-lang/php", unaffected:make_list("ge 5.2.12"), vulnerable:make_list("lt 5.2.12"))) flag++;

if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());
  else security_hole(0);
  exit(0);
}
else
{
  tested = qpkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "PHP");
}

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Red Hat Security Advisory RHSA-2009:0338 and 
# CentOS Errata and Security Advisory 2009:0338 respectively.
#

include("compat.inc");

if (description)
{
  script_id(43732);
  script_version("1.18");
  script_cvs_date("Date: 2019/10/25 13:36:04");

  script_cve_id("CVE-2008-3658", "CVE-2008-3660", "CVE-2008-5498", "CVE-2008-5557", "CVE-2008-5814", "CVE-2009-0754");
  script_bugtraq_id(30649, 31612, 32948, 33002, 33542);
  script_xref(name:"RHSA", value:"2009:0338");

  script_name(english:"CentOS 5 : php (CESA-2009:0338)");
  script_summary(english:"Checks rpm output for the updated packages");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote CentOS host is missing one or more security updates."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Updated php packages that fix several security issues are now
available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the
Red Hat Security Response Team.

PHP is an HTML-embedded scripting language commonly used with the
Apache HTTP Web server.

A heap-based buffer overflow flaw was found in PHP's mbstring
extension. A remote attacker able to pass arbitrary input to a PHP
script using mbstring conversion functions could cause the PHP
interpreter to crash or, possibly, execute arbitrary code.
(CVE-2008-5557)

A flaw was found in the handling of the 'mbstring.func_overload'
configuration setting. A value set for one virtual host, or in a
user's .htaccess file, was incorrectly applied to other virtual hosts
on the same server, causing the handling of multibyte character
strings to not work correctly. (CVE-2009-0754)

A buffer overflow flaw was found in PHP's imageloadfont function. If a
PHP script allowed a remote attacker to load a carefully crafted font
file, it could cause the PHP interpreter to crash or, possibly,
execute arbitrary code. (CVE-2008-3658)

A flaw was found in the way PHP handled certain file extensions when
running in FastCGI mode. If the PHP interpreter was being executed via
FastCGI, a remote attacker could create a request which would cause
the PHP interpreter to crash. (CVE-2008-3660)

A memory disclosure flaw was found in the PHP gd extension's
imagerotate function. A remote attacker able to pass arbitrary values
as the 'background color' argument of the function could, possibly,
view portions of the PHP interpreter's memory. (CVE-2008-5498)

A cross-site scripting flaw was found in a way PHP reported errors for
invalid cookies. If the PHP interpreter had 'display_errors' enabled,
a remote attacker able to set a specially crafted cookie on a victim's
system could possibly inject arbitrary HTML into an error message
generated by PHP. (CVE-2008-5814)

All php users are advised to upgrade to these updated packages, which
contain backported patches to resolve these issues. The httpd web
server must be restarted for the changes to take effect."
  );
  # https://lists.centos.org/pipermail/centos-announce/2009-April/015724.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?607ae89b"
  );
  # https://lists.centos.org/pipermail/centos-announce/2009-April/015725.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?6d2cb33c"
  );
  script_set_attribute(attribute:"solution", value:"Update the affected php packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(20, 79, 119, 134, 200);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:php");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:php-bcmath");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:php-cli");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:php-common");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:php-dba");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:php-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:php-gd");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:php-imap");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:php-ldap");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:php-mbstring");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:php-mysql");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:php-ncurses");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:php-odbc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:php-pdo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:php-pgsql");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:php-snmp");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:php-soap");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:php-xml");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:php-xmlrpc");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:centos:centos:5");

  script_set_attribute(attribute:"vuln_publication_date", value:"2008/08/14");
  script_set_attribute(attribute:"patch_publication_date", value:"2009/04/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2010/01/06");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"CentOS Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/CentOS/release", "Host/CentOS/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/CentOS/release");
if (isnull(release) || "CentOS" >!< release) audit(AUDIT_OS_NOT, "CentOS");
os_ver = pregmatch(pattern: "CentOS(?: Linux)? release ([0-9]+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "CentOS");
os_ver = os_ver[1];
if (! preg(pattern:"^5([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "CentOS 5.x", "CentOS " + os_ver);

if (!get_kb_item("Host/CentOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);


cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "CentOS", cpu);


flag = 0;
if (rpm_check(release:"CentOS-5", reference:"php-5.1.6-23.2.el5_3")) flag++;
if (rpm_check(release:"CentOS-5", reference:"php-bcmath-5.1.6-23.2.el5_3")) flag++;
if (rpm_check(release:"CentOS-5", reference:"php-cli-5.1.6-23.2.el5_3")) flag++;
if (rpm_check(release:"CentOS-5", reference:"php-common-5.1.6-23.2.el5_3")) flag++;
if (rpm_check(release:"CentOS-5", reference:"php-dba-5.1.6-23.2.el5_3")) flag++;
if (rpm_check(release:"CentOS-5", reference:"php-devel-5.1.6-23.2.el5_3")) flag++;
if (rpm_check(release:"CentOS-5", reference:"php-gd-5.1.6-23.2.el5_3")) flag++;
if (rpm_check(release:"CentOS-5", reference:"php-imap-5.1.6-23.2.el5_3")) flag++;
if (rpm_check(release:"CentOS-5", reference:"php-ldap-5.1.6-23.2.el5_3")) flag++;
if (rpm_check(release:"CentOS-5", reference:"php-mbstring-5.1.6-23.2.el5_3")) flag++;
if (rpm_check(release:"CentOS-5", reference:"php-mysql-5.1.6-23.2.el5_3")) flag++;
if (rpm_check(release:"CentOS-5", reference:"php-ncurses-5.1.6-23.2.el5_3")) flag++;
if (rpm_check(release:"CentOS-5", reference:"php-odbc-5.1.6-23.2.el5_3")) flag++;
if (rpm_check(release:"CentOS-5", reference:"php-pdo-5.1.6-23.2.el5_3")) flag++;
if (rpm_check(release:"CentOS-5", reference:"php-pgsql-5.1.6-23.2.el5_3")) flag++;
if (rpm_check(release:"CentOS-5", reference:"php-snmp-5.1.6-23.2.el5_3")) flag++;
if (rpm_check(release:"CentOS-5", reference:"php-soap-5.1.6-23.2.el5_3")) flag++;
if (rpm_check(release:"CentOS-5", reference:"php-xml-5.1.6-23.2.el5_3")) flag++;
if (rpm_check(release:"CentOS-5", reference:"php-xmlrpc-5.1.6-23.2.el5_3")) flag++;


if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "php / php-bcmath / php-cli / php-common / php-dba / php-devel / etc");
}

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The text description of this plugin is (C) Novell, Inc.
#

include("compat.inc");

if (description)
{
  script_id(44687);
  script_version ("1.11");
  script_cvs_date("Date: 2019/10/25 13:36:40");

  script_cve_id("CVE-2008-5624", "CVE-2008-5625", "CVE-2008-5814", "CVE-2009-2626", "CVE-2009-2687", "CVE-2009-3546", "CVE-2009-4017", "CVE-2009-4142");

  script_name(english:"SuSE 10 Security Update : PHP5 (ZYPP Patch Number 6846)");
  script_summary(english:"Checks rpm output for the updated packages");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote SuSE 10 host is missing a security-related patch."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"This update of PHP5 fixes :

  - CVE-2008-5625: CVSS v2 Base Score: 7.5 (HIGH)
    (AV:N/AC:L/Au:N/C:P/I:P/A:P): Permissions, Privileges,
    and Access Control (CWE-264) CVE-2008-5814: CVSS v2 Base
    Score: 2.6 (LOW) (AV:N/AC:H/Au:N/C:N/I:P/A:N):
    Cross-Site Scripting (XSS) (CWE-79) CVE-2009-2626: CVSS
    v2 Base Score: 6.4 (MEDIUM)
    (AV:N/AC:L/Au:N/C:P/I:N/A:P): Other (CWE-Other)
    CVE-2009-2687: CVSS v2 Base Score: 4.3 (MEDIUM)
    (AV:N/AC:M/Au:N/C:N/I:N/A:P): Input Validation (CWE-20)
    CVE-2009-3546: CVSS v2 Base Score: 4.4 (moderate)
    (AV:L/AC:M/Au:N/C:P/I:P/A:P): Other (CWE-Other)
    CVE-2009-4017: CVSS v2 Base Score: 5.0 (moderate)
    (AV:N/AC:L/Au:N/C:N/I:N/A:P): Other (CWE-Other)
    CVE-2009-4142: CVSS v2 Base Score: 4.3 (MEDIUM)
    (AV:N/AC:M/Au:N/C:N/I:P/A:N): Cross-Site Scripting
    (XSS). (CWE-79). (CVE-2008-5624: CVSS v2 Base Score: 7.5
    (HIGH) (AV:N/AC:L/Au:N/C:P/I:P/A:P): Permissions,
    Privileges, and Access Control (CWE-264))"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2008-5624.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2008-5625.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2008-5814.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2009-2626.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2009-2687.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2009-3546.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2009-4017.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2009-4142.html"
  );
  script_set_attribute(attribute:"solution", value:"Apply ZYPP patch number 6846.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_cwe_id(20, 79, 264);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:suse:suse_linux");

  script_set_attribute(attribute:"patch_publication_date", value:"2010/02/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2010/02/23");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2010-2019 Tenable Network Security, Inc.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");

  exit(0);
}


include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) exit(0, "Local checks are not enabled.");
if (!get_kb_item("Host/SuSE/release")) exit(0, "The host is not running SuSE.");
if (!get_kb_item("Host/SuSE/rpm-list")) exit(1, "Could not obtain the list of installed packages.");

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) exit(1, "Failed to determine the architecture type.");
if (cpu >!< "x86_64" && cpu !~ "^i[3-6]86$") exit(1, "Local checks for SuSE 10 on the '"+cpu+"' architecture have not been implemented.");


flag = 0;
if (rpm_check(release:"SLES10", sp:2, reference:"apache2-mod_php5-5.2.5-9.23.3")) flag++;
if (rpm_check(release:"SLES10", sp:2, reference:"php5-5.2.5-9.23.3")) flag++;
if (rpm_check(release:"SLES10", sp:2, reference:"php5-bcmath-5.2.5-9.23.3")) flag++;
if (rpm_check(release:"SLES10", sp:2, reference:"php5-bz2-5.2.5-9.23.3")) flag++;
if (rpm_check(release:"SLES10", sp:2, reference:"php5-calendar-5.2.5-9.23.3")) flag++;
if (rpm_check(release:"SLES10", sp:2, reference:"php5-ctype-5.2.5-9.23.3")) flag++;
if (rpm_check(release:"SLES10", sp:2, reference:"php5-curl-5.2.5-9.23.3")) flag++;
if (rpm_check(release:"SLES10", sp:2, reference:"php5-dba-5.2.5-9.23.3")) flag++;
if (rpm_check(release:"SLES10", sp:2, reference:"php5-dbase-5.2.5-9.23.3")) flag++;
if (rpm_check(release:"SLES10", sp:2, reference:"php5-devel-5.2.5-9.23.3")) flag++;
if (rpm_check(release:"SLES10", sp:2, reference:"php5-dom-5.2.5-9.23.3")) flag++;
if (rpm_check(release:"SLES10", sp:2, reference:"php5-exif-5.2.5-9.23.3")) flag++;
if (rpm_check(release:"SLES10", sp:2, reference:"php5-fastcgi-5.2.5-9.23.3")) flag++;
if (rpm_check(release:"SLES10", sp:2, reference:"php5-ftp-5.2.5-9.23.3")) flag++;
if (rpm_check(release:"SLES10", sp:2, reference:"php5-gd-5.2.5-9.23.3")) flag++;
if (rpm_check(release:"SLES10", sp:2, reference:"php5-gettext-5.2.5-9.23.3")) flag++;
if (rpm_check(release:"SLES10", sp:2, reference:"php5-gmp-5.2.5-9.23.3")) flag++;
if (rpm_check(release:"SLES10", sp:2, reference:"php5-hash-5.2.5-9.23.3")) flag++;
if (rpm_check(release:"SLES10", sp:2, reference:"php5-iconv-5.2.5-9.23.3")) flag++;
if (rpm_check(release:"SLES10", sp:2, reference:"php5-imap-5.2.5-9.23.3")) flag++;
if (rpm_check(release:"SLES10", sp:2, reference:"php5-json-5.2.5-9.23.3")) flag++;
if (rpm_check(release:"SLES10", sp:2, reference:"php5-ldap-5.2.5-9.23.3")) flag++;
if (rpm_check(release:"SLES10", sp:2, reference:"php5-mbstring-5.2.5-9.23.3")) flag++;
if (rpm_check(release:"SLES10", sp:2, reference:"php5-mcrypt-5.2.5-9.23.3")) flag++;
if (rpm_check(release:"SLES10", sp:2, reference:"php5-mhash-5.2.5-9.23.3")) flag++;
if (rpm_check(release:"SLES10", sp:2, reference:"php5-mysql-5.2.5-9.23.3")) flag++;
if (rpm_check(release:"SLES10", sp:2, reference:"php5-ncurses-5.2.5-9.23.3")) flag++;
if (rpm_check(release:"SLES10", sp:2, reference:"php5-odbc-5.2.5-9.23.3")) flag++;
if (rpm_check(release:"SLES10", sp:2, reference:"php5-openssl-5.2.5-9.23.3")) flag++;
if (rpm_check(release:"SLES10", sp:2, reference:"php5-pcntl-5.2.5-9.23.3")) flag++;
if (rpm_check(release:"SLES10", sp:2, reference:"php5-pdo-5.2.5-9.23.3")) flag++;
if (rpm_check(release:"SLES10", sp:2, reference:"php5-pear-5.2.5-9.23.3")) flag++;
if (rpm_check(release:"SLES10", sp:2, reference:"php5-pgsql-5.2.5-9.23.3")) flag++;
if (rpm_check(release:"SLES10", sp:2, reference:"php5-posix-5.2.5-9.23.3")) flag++;
if (rpm_check(release:"SLES10", sp:2, reference:"php5-pspell-5.2.5-9.23.3")) flag++;
if (rpm_check(release:"SLES10", sp:2, reference:"php5-shmop-5.2.5-9.23.3")) flag++;
if (rpm_check(release:"SLES10", sp:2, reference:"php5-snmp-5.2.5-9.23.3")) flag++;
if (rpm_check(release:"SLES10", sp:2, reference:"php5-soap-5.2.5-9.23.3")) flag++;
if (rpm_check(release:"SLES10", sp:2, reference:"php5-sockets-5.2.5-9.23.3")) flag++;
if (rpm_check(release:"SLES10", sp:2, reference:"php5-sqlite-5.2.5-9.23.3")) flag++;
if (rpm_check(release:"SLES10", sp:2, reference:"php5-suhosin-5.2.5-9.23.3")) flag++;
if (rpm_check(release:"SLES10", sp:2, reference:"php5-sysvmsg-5.2.5-9.23.3")) flag++;
if (rpm_check(release:"SLES10", sp:2, reference:"php5-sysvsem-5.2.5-9.23.3")) flag++;
if (rpm_check(release:"SLES10", sp:2, reference:"php5-sysvshm-5.2.5-9.23.3")) flag++;
if (rpm_check(release:"SLES10", sp:2, reference:"php5-tokenizer-5.2.5-9.23.3")) flag++;
if (rpm_check(release:"SLES10", sp:2, reference:"php5-wddx-5.2.5-9.23.3")) flag++;
if (rpm_check(release:"SLES10", sp:2, reference:"php5-xmlreader-5.2.5-9.23.3")) flag++;
if (rpm_check(release:"SLES10", sp:2, reference:"php5-xmlrpc-5.2.5-9.23.3")) flag++;
if (rpm_check(release:"SLES10", sp:2, reference:"php5-xsl-5.2.5-9.23.3")) flag++;
if (rpm_check(release:"SLES10", sp:2, reference:"php5-zlib-5.2.5-9.23.3")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
  else security_hole(0);
  exit(0);
}
else exit(0, "The host is not affected.");

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Red Hat Security Advisory RHSA-2009:0338. The text 
# itself is copyright (C) Red Hat, Inc.
#

include("compat.inc");

if (description)
{
  script_id(36098);
  script_version ("1.26");
  script_cvs_date("Date: 2019/10/25 13:36:14");

  script_cve_id("CVE-2008-3658", "CVE-2008-3660", "CVE-2008-5498", "CVE-2008-5557", "CVE-2008-5814", "CVE-2009-0754");
  script_bugtraq_id(30649, 31612, 32948, 33002, 33542);
  script_xref(name:"RHSA", value:"2009:0338");

  script_name(english:"RHEL 5 : php (RHSA-2009:0338)");
  script_summary(english:"Checks the rpm output for the updated packages");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Red Hat host is missing one or more security updates."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Updated php packages that fix several security issues are now
available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the
Red Hat Security Response Team.

PHP is an HTML-embedded scripting language commonly used with the
Apache HTTP Web server.

A heap-based buffer overflow flaw was found in PHP's mbstring
extension. A remote attacker able to pass arbitrary input to a PHP
script using mbstring conversion functions could cause the PHP
interpreter to crash or, possibly, execute arbitrary code.
(CVE-2008-5557)

A flaw was found in the handling of the 'mbstring.func_overload'
configuration setting. A value set for one virtual host, or in a
user's .htaccess file, was incorrectly applied to other virtual hosts
on the same server, causing the handling of multibyte character
strings to not work correctly. (CVE-2009-0754)

A buffer overflow flaw was found in PHP's imageloadfont function. If a
PHP script allowed a remote attacker to load a carefully crafted font
file, it could cause the PHP interpreter to crash or, possibly,
execute arbitrary code. (CVE-2008-3658)

A flaw was found in the way PHP handled certain file extensions when
running in FastCGI mode. If the PHP interpreter was being executed via
FastCGI, a remote attacker could create a request which would cause
the PHP interpreter to crash. (CVE-2008-3660)

A memory disclosure flaw was found in the PHP gd extension's
imagerotate function. A remote attacker able to pass arbitrary values
as the 'background color' argument of the function could, possibly,
view portions of the PHP interpreter's memory. (CVE-2008-5498)

A cross-site scripting flaw was found in a way PHP reported errors for
invalid cookies. If the PHP interpreter had 'display_errors' enabled,
a remote attacker able to set a specially crafted cookie on a victim's
system could possibly inject arbitrary HTML into an error message
generated by PHP. (CVE-2008-5814)

All php users are advised to upgrade to these updated packages, which
contain backported patches to resolve these issues. The httpd web
server must be restarted for the changes to take effect."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/security/cve/cve-2008-3658"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/security/cve/cve-2008-3660"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/security/cve/cve-2008-5498"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/security/cve/cve-2008-5557"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/security/cve/cve-2008-5814"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/security/cve/cve-2009-0754"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/errata/RHSA-2009:0338"
  );
  script_set_attribute(attribute:"solution", value:"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(20, 79, 119, 134, 200);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php-bcmath");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php-cli");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php-common");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php-dba");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php-gd");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php-imap");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php-ldap");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php-mbstring");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php-mysql");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php-ncurses");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php-odbc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php-pdo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php-pgsql");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php-snmp");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php-soap");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php-xml");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php-xmlrpc");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:5");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:5.3");

  script_set_attribute(attribute:"vuln_publication_date", value:"2008/08/14");
  script_set_attribute(attribute:"patch_publication_date", value:"2009/04/06");
  script_set_attribute(attribute:"plugin_publication_date", value:"2009/04/07");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Red Hat Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat");
os_ver = os_ver[1];
if (! preg(pattern:"^5([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 5.x", "Red Hat " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu);

yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo");
if (!empty_or_null(yum_updateinfo)) 
{
  rhsa = "RHSA-2009:0338";
  yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);
  if (!empty_or_null(yum_report))
  {
    security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : yum_report 
    );
    exit(0);
  }
  else
  {
    audit_message = "affected by Red Hat security advisory " + rhsa;
    audit(AUDIT_OS_NOT, audit_message);
  }
}
else
{
  flag = 0;
  if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php-5.1.6-23.2.el5_3")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php-5.1.6-23.2.el5_3")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php-5.1.6-23.2.el5_3")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php-bcmath-5.1.6-23.2.el5_3")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php-bcmath-5.1.6-23.2.el5_3")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php-bcmath-5.1.6-23.2.el5_3")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php-cli-5.1.6-23.2.el5_3")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php-cli-5.1.6-23.2.el5_3")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php-cli-5.1.6-23.2.el5_3")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php-common-5.1.6-23.2.el5_3")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php-common-5.1.6-23.2.el5_3")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php-common-5.1.6-23.2.el5_3")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php-dba-5.1.6-23.2.el5_3")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php-dba-5.1.6-23.2.el5_3")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php-dba-5.1.6-23.2.el5_3")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php-devel-5.1.6-23.2.el5_3")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php-devel-5.1.6-23.2.el5_3")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php-devel-5.1.6-23.2.el5_3")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php-gd-5.1.6-23.2.el5_3")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php-gd-5.1.6-23.2.el5_3")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php-gd-5.1.6-23.2.el5_3")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php-imap-5.1.6-23.2.el5_3")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php-imap-5.1.6-23.2.el5_3")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php-imap-5.1.6-23.2.el5_3")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php-ldap-5.1.6-23.2.el5_3")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php-ldap-5.1.6-23.2.el5_3")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php-ldap-5.1.6-23.2.el5_3")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php-mbstring-5.1.6-23.2.el5_3")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php-mbstring-5.1.6-23.2.el5_3")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php-mbstring-5.1.6-23.2.el5_3")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php-mysql-5.1.6-23.2.el5_3")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php-mysql-5.1.6-23.2.el5_3")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php-mysql-5.1.6-23.2.el5_3")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php-ncurses-5.1.6-23.2.el5_3")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php-ncurses-5.1.6-23.2.el5_3")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php-ncurses-5.1.6-23.2.el5_3")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php-odbc-5.1.6-23.2.el5_3")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php-odbc-5.1.6-23.2.el5_3")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php-odbc-5.1.6-23.2.el5_3")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php-pdo-5.1.6-23.2.el5_3")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php-pdo-5.1.6-23.2.el5_3")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php-pdo-5.1.6-23.2.el5_3")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php-pgsql-5.1.6-23.2.el5_3")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php-pgsql-5.1.6-23.2.el5_3")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php-pgsql-5.1.6-23.2.el5_3")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php-snmp-5.1.6-23.2.el5_3")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php-snmp-5.1.6-23.2.el5_3")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php-snmp-5.1.6-23.2.el5_3")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php-soap-5.1.6-23.2.el5_3")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php-soap-5.1.6-23.2.el5_3")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php-soap-5.1.6-23.2.el5_3")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php-xml-5.1.6-23.2.el5_3")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php-xml-5.1.6-23.2.el5_3")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php-xml-5.1.6-23.2.el5_3")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php-xmlrpc-5.1.6-23.2.el5_3")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php-xmlrpc-5.1.6-23.2.el5_3")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php-xmlrpc-5.1.6-23.2.el5_3")) flag++;


  if (flag)
  {
    security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get() + redhat_report_package_caveat()
    );
    exit(0);
  }
  else
  {
    tested = pkg_tests_get();
    if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
    else audit(AUDIT_PACKAGE_NOT_INSTALLED, "php / php-bcmath / php-cli / php-common / php-dba / php-devel / etc");
  }
}

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from openSUSE Security Update apache2-mod_php5-1993.
#
# The text description of this plugin is (C) SUSE LLC.
#

include("compat.inc");

if (description)
{
  script_id(44678);
  script_version("1.10");
  script_cvs_date("Date: 2019/10/25 13:36:37");

  script_cve_id("CVE-2008-5624", "CVE-2008-5625", "CVE-2008-5814", "CVE-2009-2626", "CVE-2009-2687", "CVE-2009-3546", "CVE-2009-4017", "CVE-2009-4142");

  script_name(english:"openSUSE Security Update : apache2-mod_php5 (apache2-mod_php5-1993)");
  script_summary(english:"Check for the apache2-mod_php5-1993 patch");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote openSUSE host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"This update of php5 fixes: CVE-2008-5624: CVSS v2 Base Score: 7.5
(HIGH) (AV:N/AC:L/Au:N/C:P/I:P/A:P): Permissions, Privileges, and
Access Control (CWE-264) CVE-2008-5625: CVSS v2 Base Score: 7.5 (HIGH)
(AV:N/AC:L/Au:N/C:P/I:P/A:P): Permissions, Privileges, and Access
Control (CWE-264) CVE-2008-5814: CVSS v2 Base Score: 2.6 (LOW)
(AV:N/AC:H/Au:N/C:N/I:P/A:N): Cross-Site Scripting (XSS) (CWE-79)
CVE-2009-2626: CVSS v2 Base Score: 6.4 (MEDIUM)
(AV:N/AC:L/Au:N/C:P/I:N/A:P): Other (CWE-Other) CVE-2009-2687: CVSS v2
Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:N/A:P): Input
Validation (CWE-20) CVE-2009-3546: CVSS v2 Base Score: 4.4 (moderate)
(AV:L/AC:M/Au:N/C:P/I:P/A:P): Other (CWE-Other) CVE-2009-4017: CVSS v2
Base Score: 5.0 (moderate) (AV:N/AC:L/Au:N/C:N/I:N/A:P): Other
(CWE-Other) CVE-2009-4142: CVSS v2 Base Score: 4.3 (MEDIUM)
(AV:N/AC:M/Au:N/C:N/I:P/A:N): Cross-Site Scripting (XSS) (CWE-79)"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://cve.mitre.org/cgi-bin/cvename.cgi?name=none"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.novell.com/show_bug.cgi?id=557157"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected apache2-mod_php5 packages."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_cwe_id(20, 79, 264);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:apache2-mod_php5");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-bcmath");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-bz2");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-calendar");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-ctype");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-curl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-dba");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-dbase");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-dom");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-exif");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-fastcgi");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-ftp");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-gd");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-gettext");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-gmp");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-hash");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-iconv");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-imap");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-json");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-ldap");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-mbstring");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-mcrypt");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-mysql");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-ncurses");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-odbc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-openssl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-pcntl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-pdo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-pear");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-pgsql");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-posix");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-pspell");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-readline");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-shmop");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-snmp");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-soap");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-sockets");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-sqlite");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-suhosin");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-sysvmsg");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-sysvsem");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-sysvshm");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-tidy");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-tokenizer");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-wddx");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-xmlreader");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-xmlrpc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-xmlwriter");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-xsl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-zip");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-zlib");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:11.0");

  script_set_attribute(attribute:"patch_publication_date", value:"2010/02/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2010/02/23");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2010-2019 Tenable Network Security, Inc.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
if (release !~ "^(SUSE11\.0)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "11.0", release);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

ourarch = get_kb_item("Host/cpu");
if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);

flag = 0;

if ( rpm_check(release:"SUSE11.0", reference:"apache2-mod_php5-5.2.12-0.1") ) flag++;
if ( rpm_check(release:"SUSE11.0", reference:"php5-5.2.12-0.1") ) flag++;
if ( rpm_check(release:"SUSE11.0", reference:"php5-bcmath-5.2.12-0.1") ) flag++;
if ( rpm_check(release:"SUSE11.0", reference:"php5-bz2-5.2.12-0.1") ) flag++;
if ( rpm_check(release:"SUSE11.0", reference:"php5-calendar-5.2.12-0.1") ) flag++;
if ( rpm_check(release:"SUSE11.0", reference:"php5-ctype-5.2.12-0.1") ) flag++;
if ( rpm_check(release:"SUSE11.0", reference:"php5-curl-5.2.12-0.1") ) flag++;
if ( rpm_check(release:"SUSE11.0", reference:"php5-dba-5.2.12-0.1") ) flag++;
if ( rpm_check(release:"SUSE11.0", reference:"php5-dbase-5.2.12-0.1") ) flag++;
if ( rpm_check(release:"SUSE11.0", reference:"php5-devel-5.2.12-0.1") ) flag++;
if ( rpm_check(release:"SUSE11.0", reference:"php5-dom-5.2.12-0.1") ) flag++;
if ( rpm_check(release:"SUSE11.0", reference:"php5-exif-5.2.12-0.1") ) flag++;
if ( rpm_check(release:"SUSE11.0", reference:"php5-fastcgi-5.2.12-0.1") ) flag++;
if ( rpm_check(release:"SUSE11.0", reference:"php5-ftp-5.2.12-0.1") ) flag++;
if ( rpm_check(release:"SUSE11.0", reference:"php5-gd-5.2.12-0.1") ) flag++;
if ( rpm_check(release:"SUSE11.0", reference:"php5-gettext-5.2.12-0.1") ) flag++;
if ( rpm_check(release:"SUSE11.0", reference:"php5-gmp-5.2.12-0.1") ) flag++;
if ( rpm_check(release:"SUSE11.0", reference:"php5-hash-5.2.12-0.1") ) flag++;
if ( rpm_check(release:"SUSE11.0", reference:"php5-iconv-5.2.12-0.1") ) flag++;
if ( rpm_check(release:"SUSE11.0", reference:"php5-imap-5.2.12-0.1") ) flag++;
if ( rpm_check(release:"SUSE11.0", reference:"php5-json-5.2.12-0.1") ) flag++;
if ( rpm_check(release:"SUSE11.0", reference:"php5-ldap-5.2.12-0.1") ) flag++;
if ( rpm_check(release:"SUSE11.0", reference:"php5-mbstring-5.2.12-0.1") ) flag++;
if ( rpm_check(release:"SUSE11.0", reference:"php5-mcrypt-5.2.12-0.1") ) flag++;
if ( rpm_check(release:"SUSE11.0", reference:"php5-mysql-5.2.12-0.1") ) flag++;
if ( rpm_check(release:"SUSE11.0", reference:"php5-ncurses-5.2.12-0.1") ) flag++;
if ( rpm_check(release:"SUSE11.0", reference:"php5-odbc-5.2.12-0.1") ) flag++;
if ( rpm_check(release:"SUSE11.0", reference:"php5-openssl-5.2.12-0.1") ) flag++;
if ( rpm_check(release:"SUSE11.0", reference:"php5-pcntl-5.2.12-0.1") ) flag++;
if ( rpm_check(release:"SUSE11.0", reference:"php5-pdo-5.2.12-0.1") ) flag++;
if ( rpm_check(release:"SUSE11.0", reference:"php5-pear-5.2.12-0.1") ) flag++;
if ( rpm_check(release:"SUSE11.0", reference:"php5-pgsql-5.2.12-0.1") ) flag++;
if ( rpm_check(release:"SUSE11.0", reference:"php5-posix-5.2.12-0.1") ) flag++;
if ( rpm_check(release:"SUSE11.0", reference:"php5-pspell-5.2.12-0.1") ) flag++;
if ( rpm_check(release:"SUSE11.0", reference:"php5-readline-5.2.12-0.1") ) flag++;
if ( rpm_check(release:"SUSE11.0", reference:"php5-shmop-5.2.12-0.1") ) flag++;
if ( rpm_check(release:"SUSE11.0", reference:"php5-snmp-5.2.12-0.1") ) flag++;
if ( rpm_check(release:"SUSE11.0", reference:"php5-soap-5.2.12-0.1") ) flag++;
if ( rpm_check(release:"SUSE11.0", reference:"php5-sockets-5.2.12-0.1") ) flag++;
if ( rpm_check(release:"SUSE11.0", reference:"php5-sqlite-5.2.12-0.1") ) flag++;
if ( rpm_check(release:"SUSE11.0", reference:"php5-suhosin-5.2.12-0.1") ) flag++;
if ( rpm_check(release:"SUSE11.0", reference:"php5-sysvmsg-5.2.12-0.1") ) flag++;
if ( rpm_check(release:"SUSE11.0", reference:"php5-sysvsem-5.2.12-0.1") ) flag++;
if ( rpm_check(release:"SUSE11.0", reference:"php5-sysvshm-5.2.12-0.1") ) flag++;
if ( rpm_check(release:"SUSE11.0", reference:"php5-tidy-5.2.12-0.1") ) flag++;
if ( rpm_check(release:"SUSE11.0", reference:"php5-tokenizer-5.2.12-0.1") ) flag++;
if ( rpm_check(release:"SUSE11.0", reference:"php5-wddx-5.2.12-0.1") ) flag++;
if ( rpm_check(release:"SUSE11.0", reference:"php5-xmlreader-5.2.12-0.1") ) flag++;
if ( rpm_check(release:"SUSE11.0", reference:"php5-xmlrpc-5.2.12-0.1") ) flag++;
if ( rpm_check(release:"SUSE11.0", reference:"php5-xmlwriter-5.2.12-0.1") ) flag++;
if ( rpm_check(release:"SUSE11.0", reference:"php5-xsl-5.2.12-0.1") ) flag++;
if ( rpm_check(release:"SUSE11.0", reference:"php5-zip-5.2.12-0.1") ) flag++;
if ( rpm_check(release:"SUSE11.0", reference:"php5-zlib-5.2.12-0.1") ) flag++;

if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
  else security_hole(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "php5");
}

#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(35067);
  script_version("1.18");
  script_cvs_date("Date: 2018/11/15 20:50:18");

  script_cve_id("CVE-2008-5814", "CVE-2008-5844");
  script_bugtraq_id(32673);

  script_name(english:"PHP < 5.2.8 Multiple Vulnerabilities");
  script_summary(english:"Checks version of PHP");
 
  script_set_attribute(
    attribute:"synopsis",
    value:
"The remote web server uses a version of PHP that may be affected by
multiple vulnerabilities."
  );
  script_set_attribute(
    attribute:"description",
    value:
"According to its banner, the version of PHP installed on the remote
host is earlier than 5.2.8.  As such, it is potentially affected by
the following vulnerabilities :

  - PHP fails to properly sanitize error messages of
    arbitrary HTML or script code, would code allow for 
    cross-site scripting attacks if PHP's 'display_errors' 
    setting is enabled. (CVE-2008-5814)

  - Version 5.2.7 introduced a regression with regard to
    'magic_quotes' functionality due to an incorrect fix to 
    the filter extension.  As a result, the 
    'magic_quotes_gpc' setting remains off even if it is set 
    to on. (CVE-2008-5844)"
  );
  script_set_attribute(attribute:"see_also", value:"https://bugs.php.net/bug.php?id=42718");
  script_set_attribute(attribute:"see_also", value:"http://www.php.net/releases/5_2_8.php");
  script_set_attribute(attribute:"solution", value:"Upgrade to PHP version 5.2.8 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No exploit is required");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(16, 79);

  script_set_attribute(attribute:"plugin_publication_date", value:"2008/12/09");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:php:php");
  script_end_attributes();
 
  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2008-2018 Tenable Network Security, Inc.");

  script_dependencies("php_version.nasl");
  script_require_ports("Services/www", 80);
  script_require_keys("www/PHP");
  exit(0);
}


include("global_settings.inc");
include("misc_func.inc");
include("http.inc");
include("audit.inc");
include("webapp_func.inc");

port = get_http_port(default:80, php:TRUE);

php = get_php_from_kb(
  port : port,
  exit_on_fail : TRUE
);

version = php["ver"];
source = php["src"];

backported = get_kb_item('www/php/'+port+'/'+version+'/backported');

if (report_paranoia < 2 && backported)
  audit(AUDIT_BACKPORT_SERVICE, port, "PHP "+version+" install");

if (
  version =~ "^[0-4]\." ||
  version =~ "^5\.[01]\." ||
  version =~ "^5\.2\.[0-7]($|[^0-9])"
)
{
  set_kb_item(name:"www/"+port+"/XSS", value:TRUE);
  if (report_verbosity > 0)
  {
    report =
      '\n  Version source     : '+source +
      '\n  Installed version  : '+version+
      '\n  Fixed version      : 5.2.8\n';
    security_hole(port:port, extra:report);
  }
  else security_hole(port);
  exit(0);
}
else audit(AUDIT_LISTEN_NOT_VULN, "PHP", port, version);

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Debian Security Advisory DSA-1789. The text 
# itself is copyright (C) Software in the Public Interest, Inc.
#

include("compat.inc");

if (description)
{
  script_id(38691);
  script_version("1.16");
  script_cvs_date("Date: 2019/08/02 13:32:22");

  script_cve_id("CVE-2008-2107", "CVE-2008-2108", "CVE-2008-5557", "CVE-2008-5624", "CVE-2008-5658", "CVE-2008-5814", "CVE-2009-0754", "CVE-2009-1271");
  script_bugtraq_id(29009, 32625, 32948, 33542);
  script_xref(name:"DSA", value:"1789");

  script_name(english:"Debian DSA-1789-1 : php5 - several vulnerabilities");
  script_summary(english:"Checks dpkg output for the updated package");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Debian host is missing a security-related update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Several remote vulnerabilities have been discovered in the PHP 5
hypertext preprocessor. The Common Vulnerabilities and Exposures
project identifies the following problems.

The following four vulnerabilities have already been fixed in the
stable (lenny) version of php5 prior to the release of lenny. This
update now addresses them for etch (oldstable) as well :

  - CVE-2008-2107 / CVE-2008-2108
    The GENERATE_SEED macro has several problems that make
    predicting generated random numbers easier, facilitating
    attacks against measures that use rand() or mt_rand() as
    part of a protection.

  - CVE-2008-5557
    A buffer overflow in the mbstring extension allows
    attackers to execute arbitrary code via a crafted string
    containing an HTML entity.

  - CVE-2008-5624
    The page_uid and page_gid variables are not correctly
    set, allowing use of some functionality intended to be
    restricted to root.

  - CVE-2008-5658
    Directory traversal vulnerability in the
    ZipArchive::extractTo function allows attackers to write
    arbitrary files via a ZIP file with a file whose name
    contains .. (dot dot) sequences.

This update also addresses the following three vulnerabilities for
both oldstable (etch) and stable (lenny) :

  - CVE-2008-5814
    Cross-site scripting (XSS) vulnerability, when
    display_errors is enabled, allows remote attackers to
    inject arbitrary web script or HTML.

  - CVE-2009-0754
    When running on Apache, PHP allows local users to modify
    behavior of other sites hosted on the same web server by
    modifying the mbstring.func_overload setting within
    .htaccess, which causes this setting to be applied to
    other virtual hosts on the same server. 

  - CVE-2009-1271
    The JSON_parser function allows a denial of service
    (segmentation fault) via a malformed string to the
    json_decode API function.

Furthermore, two updates originally scheduled for the next point
update for oldstable are included in the etch package :

  - Let PHP use the system timezone database instead of the
    embedded timezone database which is out of date.
  - From the source tarball, the unused 'dbase' module has
    been removed which contained licensing problems."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=507101"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=507857"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=508021"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=511493"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=523028"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=523049"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2008-2107"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2008-2108"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2008-5557"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2008-5624"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2008-5658"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2008-5814"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2009-0754"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2009-1271"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.debian.org/security/2009/dsa-1789"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"Upgrade the php5 package.

For the old stable distribution (etch), these problems have been fixed
in version 5.2.0+dfsg-8+etch15.


For the stable distribution (lenny), these problems have been fixed in
version 5.2.6.dfsg.1-1+lenny3."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(22, 79, 119, 134, 189, 264);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php5");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:4.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:5.0");

  script_set_attribute(attribute:"patch_publication_date", value:"2009/05/04");
  script_set_attribute(attribute:"plugin_publication_date", value:"2009/05/06");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Debian Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}


include("audit.inc");
include("debian_package.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;
if (deb_check(release:"4.0", prefix:"libapache-mod-php5", reference:"5.2.0+dfsg-8+etch15")) flag++;
if (deb_check(release:"4.0", prefix:"libapache2-mod-php5", reference:"5.2.0+dfsg-8+etch15")) flag++;
if (deb_check(release:"4.0", prefix:"php-pear", reference:"5.2.0+dfsg-8+etch15")) flag++;
if (deb_check(release:"4.0", prefix:"php5", reference:"5.2.0+dfsg-8+etch15")) flag++;
if (deb_check(release:"4.0", prefix:"php5-cgi", reference:"5.2.0+dfsg-8+etch15")) flag++;
if (deb_check(release:"4.0", prefix:"php5-cli", reference:"5.2.0+dfsg-8+etch15")) flag++;
if (deb_check(release:"4.0", prefix:"php5-common", reference:"5.2.0+dfsg-8+etch15")) flag++;
if (deb_check(release:"4.0", prefix:"php5-curl", reference:"5.2.0+dfsg-8+etch15")) flag++;
if (deb_check(release:"4.0", prefix:"php5-dev", reference:"5.2.0+dfsg-8+etch15")) flag++;
if (deb_check(release:"4.0", prefix:"php5-gd", reference:"5.2.0+dfsg-8+etch15")) flag++;
if (deb_check(release:"4.0", prefix:"php5-imap", reference:"5.2.0+dfsg-8+etch15")) flag++;
if (deb_check(release:"4.0", prefix:"php5-interbase", reference:"5.2.0+dfsg-8+etch15")) flag++;
if (deb_check(release:"4.0", prefix:"php5-ldap", reference:"5.2.0+dfsg-8+etch15")) flag++;
if (deb_check(release:"4.0", prefix:"php5-mcrypt", reference:"5.2.0+dfsg-8+etch15")) flag++;
if (deb_check(release:"4.0", prefix:"php5-mhash", reference:"5.2.0+dfsg-8+etch15")) flag++;
if (deb_check(release:"4.0", prefix:"php5-mysql", reference:"5.2.0+dfsg-8+etch15")) flag++;
if (deb_check(release:"4.0", prefix:"php5-odbc", reference:"5.2.0+dfsg-8+etch15")) flag++;
if (deb_check(release:"4.0", prefix:"php5-pgsql", reference:"5.2.0+dfsg-8+etch15")) flag++;
if (deb_check(release:"4.0", prefix:"php5-pspell", reference:"5.2.0+dfsg-8+etch15")) flag++;
if (deb_check(release:"4.0", prefix:"php5-recode", reference:"5.2.0+dfsg-8+etch15")) flag++;
if (deb_check(release:"4.0", prefix:"php5-snmp", reference:"5.2.0+dfsg-8+etch15")) flag++;
if (deb_check(release:"4.0", prefix:"php5-sqlite", reference:"5.2.0+dfsg-8+etch15")) flag++;
if (deb_check(release:"4.0", prefix:"php5-sybase", reference:"5.2.0+dfsg-8+etch15")) flag++;
if (deb_check(release:"4.0", prefix:"php5-tidy", reference:"5.2.0+dfsg-8+etch15")) flag++;
if (deb_check(release:"4.0", prefix:"php5-xmlrpc", reference:"5.2.0+dfsg-8+etch15")) flag++;
if (deb_check(release:"4.0", prefix:"php5-xsl", reference:"5.2.0+dfsg-8+etch15")) flag++;
if (deb_check(release:"5.0", prefix:"libapache2-mod-php5", reference:"5.2.6.dfsg.1-1+lenny3")) flag++;
if (deb_check(release:"5.0", prefix:"libapache2-mod-php5filter", reference:"5.2.6.dfsg.1-1+lenny3")) flag++;
if (deb_check(release:"5.0", prefix:"php-pear", reference:"5.2.6.dfsg.1-1+lenny3")) flag++;
if (deb_check(release:"5.0", prefix:"php5", reference:"5.2.6.dfsg.1-1+lenny3")) flag++;
if (deb_check(release:"5.0", prefix:"php5-cgi", reference:"5.2.6.dfsg.1-1+lenny3")) flag++;
if (deb_check(release:"5.0", prefix:"php5-cli", reference:"5.2.6.dfsg.1-1+lenny3")) flag++;
if (deb_check(release:"5.0", prefix:"php5-common", reference:"5.2.6.dfsg.1-1+lenny3")) flag++;
if (deb_check(release:"5.0", prefix:"php5-curl", reference:"5.2.6.dfsg.1-1+lenny3")) flag++;
if (deb_check(release:"5.0", prefix:"php5-dbg", reference:"5.2.6.dfsg.1-1+lenny3")) flag++;
if (deb_check(release:"5.0", prefix:"php5-dev", reference:"5.2.6.dfsg.1-1+lenny3")) flag++;
if (deb_check(release:"5.0", prefix:"php5-gd", reference:"5.2.6.dfsg.1-1+lenny3")) flag++;
if (deb_check(release:"5.0", prefix:"php5-gmp", reference:"5.2.6.dfsg.1-1+lenny3")) flag++;
if (deb_check(release:"5.0", prefix:"php5-imap", reference:"5.2.6.dfsg.1-1+lenny3")) flag++;
if (deb_check(release:"5.0", prefix:"php5-interbase", reference:"5.2.6.dfsg.1-1+lenny3")) flag++;
if (deb_check(release:"5.0", prefix:"php5-ldap", reference:"5.2.6.dfsg.1-1+lenny3")) flag++;
if (deb_check(release:"5.0", prefix:"php5-mcrypt", reference:"5.2.6.dfsg.1-1+lenny3")) flag++;
if (deb_check(release:"5.0", prefix:"php5-mhash", reference:"5.2.6.dfsg.1-1+lenny3")) flag++;
if (deb_check(release:"5.0", prefix:"php5-mysql", reference:"5.2.6.dfsg.1-1+lenny3")) flag++;
if (deb_check(release:"5.0", prefix:"php5-odbc", reference:"5.2.6.dfsg.1-1+lenny3")) flag++;
if (deb_check(release:"5.0", prefix:"php5-pgsql", reference:"5.2.6.dfsg.1-1+lenny3")) flag++;
if (deb_check(release:"5.0", prefix:"php5-pspell", reference:"5.2.6.dfsg.1-1+lenny3")) flag++;
if (deb_check(release:"5.0", prefix:"php5-recode", reference:"5.2.6.dfsg.1-1+lenny3")) flag++;
if (deb_check(release:"5.0", prefix:"php5-snmp", reference:"5.2.6.dfsg.1-1+lenny3")) flag++;
if (deb_check(release:"5.0", prefix:"php5-sqlite", reference:"5.2.6.dfsg.1-1+lenny3")) flag++;
if (deb_check(release:"5.0", prefix:"php5-sybase", reference:"5.2.6.dfsg.1-1+lenny3")) flag++;
if (deb_check(release:"5.0", prefix:"php5-tidy", reference:"5.2.6.dfsg.1-1+lenny3")) flag++;
if (deb_check(release:"5.0", prefix:"php5-xmlrpc", reference:"5.2.6.dfsg.1-1+lenny3")) flag++;
if (deb_check(release:"5.0", prefix:"php5-xsl", reference:"5.2.6.dfsg.1-1+lenny3")) flag++;

if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());
  else security_hole(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text is (C) Scientific Linux.
#

include("compat.inc");

if (description)
{
  script_id(60561);
  script_version("1.6");
  script_cvs_date("Date: 2019/10/25 13:36:18");

  script_cve_id("CVE-2008-3658", "CVE-2008-3660", "CVE-2008-5498", "CVE-2008-5557", "CVE-2008-5814", "CVE-2009-0754");

  script_name(english:"Scientific Linux Security Update : php on SL3.x, SL4.x, SL5.x i386/x86_64");
  script_summary(english:"Checks rpm output for the updated packages");

  script_set_attribute(
    attribute:"synopsis", 
    value:
"The remote Scientific Linux host is missing one or more security
updates."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"A heap-based buffer overflow flaw was found in PHP's mbstring
extension. A remote attacker able to pass arbitrary input to a PHP
script using mbstring conversion functions could cause the PHP
interpreter to crash or, possibly, execute arbitrary code.
(CVE-2008-5557)

A flaw was found in the handling of the 'mbstring.func_overload'
configuration setting. A value set for one virtual host, or in a
user's .htaccess file, was incorrectly applied to other virtual hosts
on the same server, causing the handling of multibyte character
strings to not work correctly. (CVE-2009-0754)

A buffer overflow flaw was found in PHP's imageloadfont function. If a
PHP script allowed a remote attacker to load a carefully crafted font
file, it could cause the PHP interpreter to crash or, possibly,
execute arbitrary code. (CVE-2008-3658)

A flaw was found in the way PHP handled certain file extensions when
running in FastCGI mode. If the PHP interpreter was being executed via
FastCGI, a remote attacker could create a request which would cause
the PHP interpreter to crash. (CVE-2008-3660)

A cross-site scripting flaw was found in a way PHP reported errors for
invalid cookies. If the PHP interpreter had 'display_errors' enabled,
a remote attacker able to set a specially crafted cookie on a victim's
system could possibly inject arbitrary HTML into an error message
generated by PHP. (CVE-2008-5814) - SL5 Only

A memory disclosure flaw was found in the PHP gd extension's
imagerotate function. A remote attacker able to pass arbitrary values
as the 'background color' argument of the function could, possibly,
view portions of the PHP interpreter's memory. (CVE-2008-5498)

The httpd web server must be restarted for the changes to take effect."
  );
  # https://listserv.fnal.gov/scripts/wa.exe?A2=ind0904&L=scientific-linux-errata&T=0&P=334
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?f108d250"
  );
  script_set_attribute(attribute:"solution", value:"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_cwe_id(20, 79, 119, 134, 200);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"x-cpe:/o:fermilab:scientific_linux");

  script_set_attribute(attribute:"patch_publication_date", value:"2009/04/06");
  script_set_attribute(attribute:"plugin_publication_date", value:"2012/08/01");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Scientific Linux Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Scientific Linux " >!< release) audit(AUDIT_HOST_NOT, "running Scientific Linux");
if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if (cpu >!< "x86_64" && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Scientific Linux", cpu);


flag = 0;
if (rpm_check(release:"SL3", reference:"php-4.3.2-51.ent")) flag++;
if (rpm_check(release:"SL3", reference:"php-devel-4.3.2-51.ent")) flag++;
if (rpm_check(release:"SL3", reference:"php-imap-4.3.2-51.ent")) flag++;
if (rpm_check(release:"SL3", reference:"php-ldap-4.3.2-51.ent")) flag++;
if (rpm_check(release:"SL3", reference:"php-mysql-4.3.2-51.ent")) flag++;
if (rpm_check(release:"SL3", reference:"php-odbc-4.3.2-51.ent")) flag++;
if (rpm_check(release:"SL3", reference:"php-pgsql-4.3.2-51.ent")) flag++;

if (rpm_check(release:"SL4", reference:"php-4.3.9-3.22.15")) flag++;
if (rpm_check(release:"SL4", reference:"php-devel-4.3.9-3.22.15")) flag++;
if (rpm_check(release:"SL4", reference:"php-domxml-4.3.9-3.22.15")) flag++;
if (rpm_check(release:"SL4", reference:"php-gd-4.3.9-3.22.15")) flag++;
if (rpm_check(release:"SL4", reference:"php-imap-4.3.9-3.22.15")) flag++;
if (rpm_check(release:"SL4", reference:"php-ldap-4.3.9-3.22.15")) flag++;
if (rpm_check(release:"SL4", reference:"php-mbstring-4.3.9-3.22.15")) flag++;
if (rpm_check(release:"SL4", reference:"php-mysql-4.3.9-3.22.15")) flag++;
if (rpm_check(release:"SL4", reference:"php-ncurses-4.3.9-3.22.15")) flag++;
if (rpm_check(release:"SL4", reference:"php-odbc-4.3.9-3.22.15")) flag++;
if (rpm_check(release:"SL4", reference:"php-pear-4.3.9-3.22.15")) flag++;
if (rpm_check(release:"SL4", reference:"php-pgsql-4.3.9-3.22.15")) flag++;
if (rpm_check(release:"SL4", reference:"php-snmp-4.3.9-3.22.15")) flag++;
if (rpm_check(release:"SL4", reference:"php-xmlrpc-4.3.9-3.22.15")) flag++;

if (rpm_check(release:"SL5", reference:"php-5.1.6-23.2.el5_3")) flag++;
if (rpm_check(release:"SL5", reference:"php-bcmath-5.1.6-23.2.el5_3")) flag++;
if (rpm_check(release:"SL5", reference:"php-cli-5.1.6-23.2.el5_3")) flag++;
if (rpm_check(release:"SL5", reference:"php-common-5.1.6-23.2.el5_3")) flag++;
if (rpm_check(release:"SL5", reference:"php-dba-5.1.6-23.2.el5_3")) flag++;
if (rpm_check(release:"SL5", reference:"php-devel-5.1.6-23.2.el5_3")) flag++;
if (rpm_check(release:"SL5", reference:"php-gd-5.1.6-23.2.el5_3")) flag++;
if (rpm_check(release:"SL5", reference:"php-imap-5.1.6-23.2.el5_3")) flag++;
if (rpm_check(release:"SL5", reference:"php-ldap-5.1.6-23.2.el5_3")) flag++;
if (rpm_check(release:"SL5", reference:"php-mbstring-5.1.6-23.2.el5_3")) flag++;
if (rpm_check(release:"SL5", reference:"php-mysql-5.1.6-23.2.el5_3")) flag++;
if (rpm_check(release:"SL5", reference:"php-ncurses-5.1.6-23.2.el5_3")) flag++;
if (rpm_check(release:"SL5", reference:"php-odbc-5.1.6-23.2.el5_3")) flag++;
if (rpm_check(release:"SL5", reference:"php-pdo-5.1.6-23.2.el5_3")) flag++;
if (rpm_check(release:"SL5", reference:"php-pgsql-5.1.6-23.2.el5_3")) flag++;
if (rpm_check(release:"SL5", reference:"php-snmp-5.1.6-23.2.el5_3")) flag++;
if (rpm_check(release:"SL5", reference:"php-soap-5.1.6-23.2.el5_3")) flag++;
if (rpm_check(release:"SL5", reference:"php-xml-5.1.6-23.2.el5_3")) flag++;
if (rpm_check(release:"SL5", reference:"php-xmlrpc-5.1.6-23.2.el5_3")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
  else security_hole(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");