Vulnerabilities > CVE-2009-1272 - Improper Input Validation vulnerability in PHP
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
NONE Integrity impact
NONE Availability impact
PARTIAL Summary
The php_zip_make_relative_path function in php_zip.c in PHP 5.2.x before 5.2.9 allows context-dependent attackers to cause a denial of service (crash) via a ZIP file that contains filenames with relative paths, which is not properly handled during extraction.
Vulnerable Configurations
Part | Description | Count |
---|---|---|
Application | 10 |
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Buffer Overflow via Environment Variables This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
- Server Side Include (SSI) Injection An attacker can use Server Side Include (SSI) Injection to send code to a web application that then gets executed by the web server. Doing so enables the attacker to achieve similar results to Cross Site Scripting, viz., arbitrary code execution and information disclosure, albeit on a more limited scale, since the SSI directives are nowhere near as powerful as a full-fledged scripting language. Nonetheless, the attacker can conveniently gain access to sensitive files, such as password files, and execute shell commands.
- Cross Zone Scripting An attacker is able to cause a victim to load content into their web-browser that bypasses security zone controls and gain access to increased privileges to execute scripting code or other web objects such as unsigned ActiveX controls or applets. This is a privilege elevation attack targeted at zone-based web-browser security. In a zone-based model, pages belong to one of a set of zones corresponding to the level of privilege assigned to that page. Pages in an untrusted zone would have a lesser level of access to the system and/or be restricted in the types of executable content it was allowed to invoke. In a cross-zone scripting attack, a page that should be assigned to a less privileged zone is granted the privileges of a more trusted zone. This can be accomplished by exploiting bugs in the browser, exploiting incorrect configuration in the zone controls, through a cross-site scripting attack that causes the attackers' content to be treated as coming from a more trusted page, or by leveraging some piece of system functionality that is accessible from both the trusted and less trusted zone. This attack differs from "Restful Privilege Escalation" in that the latter correlates to the inadequate securing of RESTful access methods (such as HTTP DELETE) on the server, while cross-zone scripting attacks the concept of security zones as implemented by a browser.
- Cross Site Scripting through Log Files An attacker may leverage a system weakness where logs are susceptible to log injection to insert scripts into the system's logs. If these logs are later viewed by an administrator through a thin administrative interface and the log data is not properly HTML encoded before being written to the page, the attackers' scripts stored in the log will be executed in the administrative interface with potentially serious consequences. This attack pattern is really a combination of two other attack patterns: log injection and stored cross site scripting.
- Command Line Execution through SQL Injection An attacker uses standard SQL injection methods to inject data into the command line for execution. This could be done directly through misuse of directives such as MSSQL_xp_cmdshell or indirectly through injection of data into the database that would be interpreted as shell commands. Sometime later, an unscrupulous backend application (or could be part of the functionality of the same application) fetches the injected data stored in the database and uses this data as command line arguments without performing proper validation. The malicious data escapes that data plane by spawning new commands to be executed on the host.
Nessus
NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-201001-03.NASL description The remote host is affected by the vulnerability described in GLSA-201001-03 (PHP: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in PHP. Please review the CVE identifiers referenced below and the associated PHP release notes for details. Impact : A context-dependent attacker could execute arbitrary code via a specially crafted string containing an HTML entity when the mbstring extension is enabled. Furthermore a remote attacker could execute arbitrary code via a specially crafted GD graphics file. A remote attacker could also cause a Denial of Service via a malformed string passed to the json_decode() function, via a specially crafted ZIP file passed to the php_zip_make_relative_path() function, via a malformed JPEG image passed to the exif_read_data() function, or via temporary file exhaustion. It is also possible for an attacker to spoof certificates, bypass various safe_mode and open_basedir restrictions when certain criteria are met, perform Cross-site scripting attacks, more easily perform SQL injection attacks, manipulate settings of other virtual hosts on the same server via a malicious .htaccess entry when running on Apache, disclose memory portions, and write arbitrary files via a specially crafted ZIP archive. Some vulnerabilities with unknown impact and attack vectors have been reported as well. Workaround : There is no known workaround at this time. last seen 2020-06-01 modified 2020-06-02 plugin id 44892 published 2010-02-25 reporter This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/44892 title GLSA-201001-03 : PHP: Multiple vulnerabilities code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Gentoo Linux Security Advisory GLSA 201001-03. # # The advisory text is Copyright (C) 2001-2018 Gentoo Foundation, Inc. # and licensed under the Creative Commons - Attribution / Share Alike # license. See http://creativecommons.org/licenses/by-sa/3.0/ # include("compat.inc"); if (description) { script_id(44892); script_version("1.17"); script_cvs_date("Date: 2019/08/02 13:32:45"); script_cve_id("CVE-2008-5498", "CVE-2008-5514", "CVE-2008-5557", "CVE-2008-5624", "CVE-2008-5625", "CVE-2008-5658", "CVE-2008-5814", "CVE-2008-5844", "CVE-2008-7002", "CVE-2009-0754", "CVE-2009-1271", "CVE-2009-1272", "CVE-2009-2626", "CVE-2009-2687", "CVE-2009-3291", "CVE-2009-3292", "CVE-2009-3293", "CVE-2009-3546", "CVE-2009-3557", "CVE-2009-3558", "CVE-2009-4017", "CVE-2009-4142", "CVE-2009-4143"); script_bugtraq_id(32625, 32948, 32958, 33002, 33542, 35440, 36449, 36712, 37079, 37390); script_xref(name:"GLSA", value:"201001-03"); script_name(english:"GLSA-201001-03 : PHP: Multiple vulnerabilities"); script_summary(english:"Checks for updated package(s) in /var/db/pkg"); script_set_attribute( attribute:"synopsis", value: "The remote Gentoo host is missing one or more security-related patches." ); script_set_attribute( attribute:"description", value: "The remote host is affected by the vulnerability described in GLSA-201001-03 (PHP: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in PHP. Please review the CVE identifiers referenced below and the associated PHP release notes for details. Impact : A context-dependent attacker could execute arbitrary code via a specially crafted string containing an HTML entity when the mbstring extension is enabled. Furthermore a remote attacker could execute arbitrary code via a specially crafted GD graphics file. A remote attacker could also cause a Denial of Service via a malformed string passed to the json_decode() function, via a specially crafted ZIP file passed to the php_zip_make_relative_path() function, via a malformed JPEG image passed to the exif_read_data() function, or via temporary file exhaustion. It is also possible for an attacker to spoof certificates, bypass various safe_mode and open_basedir restrictions when certain criteria are met, perform Cross-site scripting attacks, more easily perform SQL injection attacks, manipulate settings of other virtual hosts on the same server via a malicious .htaccess entry when running on Apache, disclose memory portions, and write arbitrary files via a specially crafted ZIP archive. Some vulnerabilities with unknown impact and attack vectors have been reported as well. Workaround : There is no known workaround at this time." ); script_set_attribute( attribute:"see_also", value:"https://security.gentoo.org/glsa/200911-03" ); script_set_attribute( attribute:"see_also", value:"https://security.gentoo.org/glsa/201001-03" ); script_set_attribute( attribute:"solution", value: "All PHP users should upgrade to the latest version. As PHP is statically linked against a vulnerable version of the c-client library when the imap or kolab USE flag is enabled (GLSA 200911-03), users should upgrade net-libs/c-client beforehand: # emerge --sync # emerge --ask --oneshot --verbose '>=net-libs/c-client-2007e' # emerge --ask --oneshot --verbose '>=dev-lang/php-5.2.12'" ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_cwe_id(16, 20, 22, 79, 119, 134, 200, 264); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:php"); script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux"); script_set_attribute(attribute:"patch_publication_date", value:"2010/01/05"); script_set_attribute(attribute:"plugin_publication_date", value:"2010/02/25"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Gentoo Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("qpkg.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo"); if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING); flag = 0; if (qpkg_check(package:"dev-lang/php", unaffected:make_list("ge 5.2.12"), vulnerable:make_list("lt 5.2.12"))) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get()); else security_hole(0); exit(0); } else { tested = qpkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "PHP"); }
NASL family MacOS X Local Security Checks NASL id MACOSX_SECUPD2009-005.NASL description The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have Security Update 2009-005 applied. This security update contains fixes for the following products : - Alias Manager - CarbonCore - ClamAV - ColorSync - CoreGraphics - CUPS - Flash Player plug-in - ImageIO - Launch Services - MySQL - PHP - SMB - Wiki Server last seen 2020-06-01 modified 2020-06-02 plugin id 40945 published 2009-09-11 reporter This script is Copyright (C) 2009-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/40945 title Mac OS X Multiple Vulnerabilities (Security Update 2009-005) code # # (C) Tenable Network Security, Inc. # if (!defined_func("bn_random")) exit(0); if (NASL_LEVEL < 3004) exit(0); include("compat.inc"); if (description) { script_id(40945); script_version("1.21"); script_cvs_date("Date: 2018/07/14 1:59:35"); script_cve_id("CVE-2008-2079", "CVE-2008-5498", "CVE-2008-6680", "CVE-2009-0590", "CVE-2009-0591", "CVE-2009-0789", "CVE-2009-0949", "CVE-2009-1241", "CVE-2009-1270", "CVE-2009-1271", "CVE-2009-1272", "CVE-2009-1371", "CVE-2009-1372", "CVE-2009-1862", "CVE-2009-1863", "CVE-2009-1864", "CVE-2009-1865", "CVE-2009-1866", "CVE-2009-1867", "CVE-2009-1868", "CVE-2009-1869", "CVE-2009-1870", "CVE-2009-2468", "CVE-2009-2800", "CVE-2009-2803", "CVE-2009-2804", "CVE-2009-2805", "CVE-2009-2807", "CVE-2009-2809", "CVE-2009-2811", "CVE-2009-2812", "CVE-2009-2813", "CVE-2009-2814"); script_bugtraq_id( 29106, 33002, 34256, 34357, 35759, 36350, 36354, 36355, 36357, 36358, 36359, 36360, 36361, 36363, 36364 ); script_name(english:"Mac OS X Multiple Vulnerabilities (Security Update 2009-005)"); script_summary(english:"Check for the presence of Security Update 2009-005"); script_set_attribute( attribute:"synopsis", value: "The remote host is missing a Mac OS X update that fixes various security issues." ); script_set_attribute( attribute:"description", value: "The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have Security Update 2009-005 applied. This security update contains fixes for the following products : - Alias Manager - CarbonCore - ClamAV - ColorSync - CoreGraphics - CUPS - Flash Player plug-in - ImageIO - Launch Services - MySQL - PHP - SMB - Wiki Server" ); script_set_attribute( attribute:"see_also", value:"http://support.apple.com/kb/HT3865" ); script_set_attribute( attribute:"see_also", value:"http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html" ); script_set_attribute( attribute:"see_also", value:"http://www.securityfocus.com/advisories/17867" ); script_set_attribute( attribute:"solution", value:"Install Security Update 2009-005 or later." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"exploit_framework_core", value:"true"); script_set_attribute(attribute:"exploited_by_malware", value:"true"); script_set_attribute(attribute:"exploit_framework_canvas", value:"true"); script_set_attribute(attribute:"canvas_package", value:'CANVAS'); script_cwe_id(20, 59, 79, 94, 119, 189, 200, 264, 287, 399); script_set_attribute(attribute:"patch_publication_date", value:"2009/09/10"); script_set_attribute(attribute:"plugin_publication_date", value:"2009/09/11"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/o:apple:mac_os_x"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"MacOS X Local Security Checks"); script_copyright(english:"This script is Copyright (C) 2009-2018 Tenable Network Security, Inc."); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/MacOSX/packages", "Host/uname"); exit(0); } # uname = get_kb_item("Host/uname"); if (!uname) exit(1, "The 'Host/uname' KB item is missing."); if (egrep(pattern:"Darwin.* (8\.[0-9]\.|8\.1[01]\.)", string:uname)) { packages = get_kb_item("Host/MacOSX/packages"); if (!packages) exit(1, "The 'Host/MacOSX/packages' KB item is missing."); if (egrep(pattern:"^SecUpd(Srvr)?(2009-00[5-9]|20[1-9][0-9]-)", string:packages)) exit(0, "The host has Security Update 2009-005 or later installed and therefore is not affected."); else security_hole(0); } else if (egrep(pattern:"Darwin.* (9\.[0-8]\.)", string:uname)) { packages = get_kb_item("Host/MacOSX/packages/boms"); if (!packages) exit(1, "The 'Host/MacOSX/packages/boms' KB item is missing."); if (egrep(pattern:"^com\.apple\.pkg\.update\.security\.(2009\.00[5-9]|20[1-9][0-9]\.[0-9]+)\.bom", string:packages)) exit(0, "The host has Security Update 2009-005 or later installed and therefore is not affected."); else security_hole(0); } else exit(0, "The host is not affected.");
NASL family SuSE Local Security Checks NASL id SUSE_11_APACHE2-MOD_PHP5-090618.NASL description This update fixes the JSON parser (CVE-2009-1271) and the zip packer code (CVE-2009-1272) in php5. Both bugs can lead to a remote denial of service attack. last seen 2020-06-01 modified 2020-06-02 plugin id 41369 published 2009-09-24 reporter This script is Copyright (C) 2009-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/41369 title SuSE 11 Security Update : PHP5 (SAT Patch Number 1015) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from SuSE 11 update information. The text itself is # copyright (C) Novell, Inc. # include("compat.inc"); if (description) { script_id(41369); script_version("1.10"); script_cvs_date("Date: 2019/10/25 13:36:35"); script_cve_id("CVE-2009-1271", "CVE-2009-1272"); script_name(english:"SuSE 11 Security Update : PHP5 (SAT Patch Number 1015)"); script_summary(english:"Checks rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value:"The remote SuSE 11 host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "This update fixes the JSON parser (CVE-2009-1271) and the zip packer code (CVE-2009-1272) in php5. Both bugs can lead to a remote denial of service attack." ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=493122" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2009-1271.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2009-1272.html" ); script_set_attribute(attribute:"solution", value:"Apply SAT patch number 1015."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P"); script_cwe_id(20); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:apache2-mod_php5"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php5"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php5-bcmath"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php5-bz2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php5-calendar"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php5-ctype"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php5-curl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php5-dba"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php5-dbase"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php5-dom"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php5-exif"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php5-fastcgi"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php5-ftp"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php5-gd"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php5-gettext"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php5-gmp"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php5-hash"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php5-iconv"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php5-json"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php5-ldap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php5-mbstring"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php5-mcrypt"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php5-mysql"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php5-odbc"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php5-openssl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php5-pcntl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php5-pdo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php5-pear"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php5-pgsql"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php5-pspell"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php5-shmop"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php5-snmp"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php5-soap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php5-suhosin"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php5-sysvmsg"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php5-sysvsem"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php5-sysvshm"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php5-tokenizer"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php5-wddx"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php5-xmlreader"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php5-xmlrpc"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php5-xmlwriter"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php5-xsl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php5-zip"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php5-zlib"); script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:11"); script_set_attribute(attribute:"patch_publication_date", value:"2009/06/18"); script_set_attribute(attribute:"plugin_publication_date", value:"2009/09/24"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2009-2019 Tenable Network Security, Inc."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/SuSE/release"); if (isnull(release) || release !~ "^(SLED|SLES)11") audit(AUDIT_OS_NOT, "SuSE 11"); if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SuSE 11", cpu); pl = get_kb_item("Host/SuSE/patchlevel"); if (pl) audit(AUDIT_OS_NOT, "SuSE 11.0"); flag = 0; if (rpm_check(release:"SLES11", sp:0, reference:"apache2-mod_php5-5.2.6-50.19.1")) flag++; if (rpm_check(release:"SLES11", sp:0, reference:"php5-5.2.6-50.19.1")) flag++; if (rpm_check(release:"SLES11", sp:0, reference:"php5-bcmath-5.2.6-50.19.1")) flag++; if (rpm_check(release:"SLES11", sp:0, reference:"php5-bz2-5.2.6-50.19.1")) flag++; if (rpm_check(release:"SLES11", sp:0, reference:"php5-calendar-5.2.6-50.19.1")) flag++; if (rpm_check(release:"SLES11", sp:0, reference:"php5-ctype-5.2.6-50.19.1")) flag++; if (rpm_check(release:"SLES11", sp:0, reference:"php5-curl-5.2.6-50.19.1")) flag++; if (rpm_check(release:"SLES11", sp:0, reference:"php5-dba-5.2.6-50.19.1")) flag++; if (rpm_check(release:"SLES11", sp:0, reference:"php5-dbase-5.2.6-50.19.1")) flag++; if (rpm_check(release:"SLES11", sp:0, reference:"php5-dom-5.2.6-50.19.1")) flag++; if (rpm_check(release:"SLES11", sp:0, reference:"php5-exif-5.2.6-50.19.1")) flag++; if (rpm_check(release:"SLES11", sp:0, reference:"php5-fastcgi-5.2.6-50.19.1")) flag++; if (rpm_check(release:"SLES11", sp:0, reference:"php5-ftp-5.2.6-50.19.1")) flag++; if (rpm_check(release:"SLES11", sp:0, reference:"php5-gd-5.2.6-50.19.1")) flag++; if (rpm_check(release:"SLES11", sp:0, reference:"php5-gettext-5.2.6-50.19.1")) flag++; if (rpm_check(release:"SLES11", sp:0, reference:"php5-gmp-5.2.6-50.19.1")) flag++; if (rpm_check(release:"SLES11", sp:0, reference:"php5-hash-5.2.6-50.19.1")) flag++; if (rpm_check(release:"SLES11", sp:0, reference:"php5-iconv-5.2.6-50.19.1")) flag++; if (rpm_check(release:"SLES11", sp:0, reference:"php5-json-5.2.6-50.19.1")) flag++; if (rpm_check(release:"SLES11", sp:0, reference:"php5-ldap-5.2.6-50.19.1")) flag++; if (rpm_check(release:"SLES11", sp:0, reference:"php5-mbstring-5.2.6-50.19.1")) flag++; if (rpm_check(release:"SLES11", sp:0, reference:"php5-mcrypt-5.2.6-50.19.1")) flag++; if (rpm_check(release:"SLES11", sp:0, reference:"php5-mysql-5.2.6-50.19.1")) flag++; if (rpm_check(release:"SLES11", sp:0, reference:"php5-odbc-5.2.6-50.19.1")) flag++; if (rpm_check(release:"SLES11", sp:0, reference:"php5-openssl-5.2.6-50.19.1")) flag++; if (rpm_check(release:"SLES11", sp:0, reference:"php5-pcntl-5.2.6-50.19.1")) flag++; if (rpm_check(release:"SLES11", sp:0, reference:"php5-pdo-5.2.6-50.19.1")) flag++; if (rpm_check(release:"SLES11", sp:0, reference:"php5-pear-5.2.6-50.19.1")) flag++; if (rpm_check(release:"SLES11", sp:0, reference:"php5-pgsql-5.2.6-50.19.1")) flag++; if (rpm_check(release:"SLES11", sp:0, reference:"php5-pspell-5.2.6-50.19.1")) flag++; if (rpm_check(release:"SLES11", sp:0, reference:"php5-shmop-5.2.6-50.19.1")) flag++; if (rpm_check(release:"SLES11", sp:0, reference:"php5-snmp-5.2.6-50.19.1")) flag++; if (rpm_check(release:"SLES11", sp:0, reference:"php5-soap-5.2.6-50.19.1")) flag++; if (rpm_check(release:"SLES11", sp:0, reference:"php5-suhosin-5.2.6-50.19.1")) flag++; if (rpm_check(release:"SLES11", sp:0, reference:"php5-sysvmsg-5.2.6-50.19.1")) flag++; if (rpm_check(release:"SLES11", sp:0, reference:"php5-sysvsem-5.2.6-50.19.1")) flag++; if (rpm_check(release:"SLES11", sp:0, reference:"php5-sysvshm-5.2.6-50.19.1")) flag++; if (rpm_check(release:"SLES11", sp:0, reference:"php5-tokenizer-5.2.6-50.19.1")) flag++; if (rpm_check(release:"SLES11", sp:0, reference:"php5-wddx-5.2.6-50.19.1")) flag++; if (rpm_check(release:"SLES11", sp:0, reference:"php5-xmlreader-5.2.6-50.19.1")) flag++; if (rpm_check(release:"SLES11", sp:0, reference:"php5-xmlrpc-5.2.6-50.19.1")) flag++; if (rpm_check(release:"SLES11", sp:0, reference:"php5-xmlwriter-5.2.6-50.19.1")) flag++; if (rpm_check(release:"SLES11", sp:0, reference:"php5-xsl-5.2.6-50.19.1")) flag++; if (rpm_check(release:"SLES11", sp:0, reference:"php5-zip-5.2.6-50.19.1")) flag++; if (rpm_check(release:"SLES11", sp:0, reference:"php5-zlib-5.2.6-50.19.1")) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get()); else security_warning(0); exit(0); } else audit(AUDIT_HOST_NOT, "affected");
NASL family SuSE Local Security Checks NASL id SUSE_APACHE2-MOD_PHP5-6311.NASL description This update fixes the JSON parser (CVE-2009-1271) and the zip packer code (CVE-2009-1272) in php5. Both bugs can lead to a remote denial of service attack. last seen 2020-06-01 modified 2020-06-02 plugin id 41477 published 2009-09-24 reporter This script is Copyright (C) 2009-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/41477 title SuSE 10 Security Update : PHP5 (ZYPP Patch Number 6311) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The text description of this plugin is (C) Novell, Inc. # include("compat.inc"); if (description) { script_id(41477); script_version ("1.9"); script_cvs_date("Date: 2019/10/25 13:36:36"); script_cve_id("CVE-2009-1271", "CVE-2009-1272"); script_name(english:"SuSE 10 Security Update : PHP5 (ZYPP Patch Number 6311)"); script_summary(english:"Checks rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value:"The remote SuSE 10 host is missing a security-related patch." ); script_set_attribute( attribute:"description", value: "This update fixes the JSON parser (CVE-2009-1271) and the zip packer code (CVE-2009-1272) in php5. Both bugs can lead to a remote denial of service attack." ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2009-1271.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2009-1272.html" ); script_set_attribute(attribute:"solution", value:"Apply ZYPP patch number 6311."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P"); script_cwe_id(20); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/o:suse:suse_linux"); script_set_attribute(attribute:"patch_publication_date", value:"2009/06/17"); script_set_attribute(attribute:"plugin_publication_date", value:"2009/09/24"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2009-2019 Tenable Network Security, Inc."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list"); exit(0); } include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) exit(0, "Local checks are not enabled."); if (!get_kb_item("Host/SuSE/release")) exit(0, "The host is not running SuSE."); if (!get_kb_item("Host/SuSE/rpm-list")) exit(1, "Could not obtain the list of installed packages."); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) exit(1, "Failed to determine the architecture type."); if (cpu >!< "x86_64" && cpu !~ "^i[3-6]86$") exit(1, "Local checks for SuSE 10 on the '"+cpu+"' architecture have not been implemented."); flag = 0; if (rpm_check(release:"SLES10", sp:2, reference:"apache2-mod_php5-5.2.5-9.18")) flag++; if (rpm_check(release:"SLES10", sp:2, reference:"php5-5.2.5-9.18")) flag++; if (rpm_check(release:"SLES10", sp:2, reference:"php5-bcmath-5.2.5-9.18")) flag++; if (rpm_check(release:"SLES10", sp:2, reference:"php5-bz2-5.2.5-9.18")) flag++; if (rpm_check(release:"SLES10", sp:2, reference:"php5-calendar-5.2.5-9.18")) flag++; if (rpm_check(release:"SLES10", sp:2, reference:"php5-ctype-5.2.5-9.18")) flag++; if (rpm_check(release:"SLES10", sp:2, reference:"php5-curl-5.2.5-9.18")) flag++; if (rpm_check(release:"SLES10", sp:2, reference:"php5-dba-5.2.5-9.18")) flag++; if (rpm_check(release:"SLES10", sp:2, reference:"php5-dbase-5.2.5-9.18")) flag++; if (rpm_check(release:"SLES10", sp:2, reference:"php5-devel-5.2.5-9.18")) flag++; if (rpm_check(release:"SLES10", sp:2, reference:"php5-dom-5.2.5-9.18")) flag++; if (rpm_check(release:"SLES10", sp:2, reference:"php5-exif-5.2.5-9.18")) flag++; if (rpm_check(release:"SLES10", sp:2, reference:"php5-fastcgi-5.2.5-9.18")) flag++; if (rpm_check(release:"SLES10", sp:2, reference:"php5-ftp-5.2.5-9.18")) flag++; if (rpm_check(release:"SLES10", sp:2, reference:"php5-gd-5.2.5-9.18")) flag++; if (rpm_check(release:"SLES10", sp:2, reference:"php5-gettext-5.2.5-9.18")) flag++; if (rpm_check(release:"SLES10", sp:2, reference:"php5-gmp-5.2.5-9.18")) flag++; if (rpm_check(release:"SLES10", sp:2, reference:"php5-iconv-5.2.5-9.18")) flag++; if (rpm_check(release:"SLES10", sp:2, reference:"php5-imap-5.2.5-9.18")) flag++; if (rpm_check(release:"SLES10", sp:2, reference:"php5-json-5.2.5-9.18")) flag++; if (rpm_check(release:"SLES10", sp:2, reference:"php5-ldap-5.2.5-9.18")) flag++; if (rpm_check(release:"SLES10", sp:2, reference:"php5-mbstring-5.2.5-9.18")) flag++; if (rpm_check(release:"SLES10", sp:2, reference:"php5-mcrypt-5.2.5-9.18")) flag++; if (rpm_check(release:"SLES10", sp:2, reference:"php5-mhash-5.2.5-9.18")) flag++; if (rpm_check(release:"SLES10", sp:2, reference:"php5-mysql-5.2.5-9.18")) flag++; if (rpm_check(release:"SLES10", sp:2, reference:"php5-ncurses-5.2.5-9.18")) flag++; if (rpm_check(release:"SLES10", sp:2, reference:"php5-odbc-5.2.5-9.18")) flag++; if (rpm_check(release:"SLES10", sp:2, reference:"php5-openssl-5.2.5-9.18")) flag++; if (rpm_check(release:"SLES10", sp:2, reference:"php5-pcntl-5.2.5-9.18")) flag++; if (rpm_check(release:"SLES10", sp:2, reference:"php5-pdo-5.2.5-9.18")) flag++; if (rpm_check(release:"SLES10", sp:2, reference:"php5-pear-5.2.5-9.18")) flag++; if (rpm_check(release:"SLES10", sp:2, reference:"php5-pgsql-5.2.5-9.18")) flag++; if (rpm_check(release:"SLES10", sp:2, reference:"php5-posix-5.2.5-9.18")) flag++; if (rpm_check(release:"SLES10", sp:2, reference:"php5-pspell-5.2.5-9.18")) flag++; if (rpm_check(release:"SLES10", sp:2, reference:"php5-shmop-5.2.5-9.18")) flag++; if (rpm_check(release:"SLES10", sp:2, reference:"php5-snmp-5.2.5-9.18")) flag++; if (rpm_check(release:"SLES10", sp:2, reference:"php5-soap-5.2.5-9.18")) flag++; if (rpm_check(release:"SLES10", sp:2, reference:"php5-sockets-5.2.5-9.18")) flag++; if (rpm_check(release:"SLES10", sp:2, reference:"php5-sqlite-5.2.5-9.18")) flag++; if (rpm_check(release:"SLES10", sp:2, reference:"php5-suhosin-5.2.5-9.18")) flag++; if (rpm_check(release:"SLES10", sp:2, reference:"php5-sysvmsg-5.2.5-9.18")) flag++; if (rpm_check(release:"SLES10", sp:2, reference:"php5-sysvsem-5.2.5-9.18")) flag++; if (rpm_check(release:"SLES10", sp:2, reference:"php5-sysvshm-5.2.5-9.18")) flag++; if (rpm_check(release:"SLES10", sp:2, reference:"php5-tokenizer-5.2.5-9.18")) flag++; if (rpm_check(release:"SLES10", sp:2, reference:"php5-wddx-5.2.5-9.18")) flag++; if (rpm_check(release:"SLES10", sp:2, reference:"php5-xmlreader-5.2.5-9.18")) flag++; if (rpm_check(release:"SLES10", sp:2, reference:"php5-xmlrpc-5.2.5-9.18")) flag++; if (rpm_check(release:"SLES10", sp:2, reference:"php5-xsl-5.2.5-9.18")) flag++; if (rpm_check(release:"SLES10", sp:2, reference:"php5-zlib-5.2.5-9.18")) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get()); else security_warning(0); exit(0); } else exit(0, "The host is not affected.");
NASL family CGI abuses NASL id PHP_5_2_9.NASL description According to its banner, the version of PHP installed on the remote host is older than 5.2.9. Such versions may be affected by several security issues : - Background color is not correctly validated with a non true color image in function last seen 2020-06-01 modified 2020-06-02 plugin id 35750 published 2009-02-27 reporter This script is Copyright (C) 2009-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/35750 title PHP < 5.2.9 Multiple Vulnerabilities code # # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(35750); script_version("1.13"); script_cvs_date("Date: 2018/07/24 18:56:10"); script_cve_id("CVE-2008-5498", "CVE-2009-1271", "CVE-2009-1272"); script_bugtraq_id(33002, 33927); script_xref(name:"Secunia", value:"34081"); script_name(english:"PHP < 5.2.9 Multiple Vulnerabilities"); script_summary(english:"Checks version of PHP"); script_set_attribute( attribute:"synopsis", value: "The remote web server uses a version of PHP that is affected by multiple flaws." ); script_set_attribute( attribute:"description", value: "According to its banner, the version of PHP installed on the remote host is older than 5.2.9. Such versions may be affected by several security issues : - Background color is not correctly validated with a non true color image in function 'imagerotate()'. (CVE-2008-5498) - A denial of service condition can be triggered by trying to extract zip files that contain files with relative paths in file or directory names. - Function 'explode()' is affected by an unspecified vulnerability. - It may be possible to trigger a segfault by passing a specially crafted string to function 'json_decode()'. - Function 'xml_error_string()' is affected by a flaw which results in messages being off by one." ); script_set_attribute(attribute:"see_also", value: "http://news.php.net/php.internals/42762"); script_set_attribute(attribute:"see_also", value: "http://www.php.net/releases/5_2_9.php"); script_set_attribute(attribute:"see_also", value: "http://www.php.net/ChangeLog-5.php#5.2.9"); script_set_attribute(attribute:"solution", value: "Upgrade to PHP version 5.2.9 or later."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P"); script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No exploit is required"); script_set_attribute(attribute:"exploit_available", value:"false"); script_cwe_id(20, 200); script_set_attribute(attribute:"patch_publication_date", value:"2009/02/26"); script_set_attribute(attribute:"plugin_publication_date", value:"2009/02/27"); script_set_attribute(attribute:"plugin_type", value:"remote"); script_set_attribute(attribute:"cpe", value:"cpe:/a:php:php"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"CGI abuses"); script_copyright(english:"This script is Copyright (C) 2009-2018 Tenable Network Security, Inc."); script_dependencies("php_version.nasl"); script_require_ports("Services/www", 80); script_require_keys("www/PHP"); exit(0); } include("global_settings.inc"); include('misc_func.inc'); include("http.inc"); include("audit.inc"); include("webapp_func.inc"); port = get_http_port(default:80, php:TRUE); php = get_php_from_kb( port : port, exit_on_fail : TRUE ); version = php["ver"]; source = php["src"]; backported = get_kb_item('www/php/'+port+'/'+version+'/backported'); if (report_paranoia < 2 && backported) audit(AUDIT_BACKPORT_SERVICE, port, "PHP "+version+" install"); if (version =~ "^[0-4]\." || version =~ "^5\.[01]\." || version =~ "^5\.2\.[0-8]($|[^0-9])" ) { if (report_verbosity > 0) { report = '\n Version source : '+source + '\n Installed version : '+version+ '\n Fixed version : 5.2.9\n'; security_warning(port:port, extra:report); } else security_warning(port); exit(0); } else audit(AUDIT_LISTEN_NOT_VULN, "PHP", port, version);
Statements
contributor | Tomas Hoger |
lastmodified | 2009-04-15 |
organization | Red Hat |
statement | Not vulnerable. This issue did not affect PHP versions as shipped in Red Hat Enterprise Linux 2.1, 3, 4, and 5, and Red Hat Application Stack v1 and v2. This problem was introduced in the fix for CVE-2008-5658. Patch for CVE-2008-5658 as used in Red Hat Application Stack v2 also includes the fix for this crash too. |
References
- http://cvs.php.net/viewvc.cgi/php-src/ext/zip/php_zip.c?r1=1.1.2.48&r2=1.1.2.49
- http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html
- http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html
- http://marc.info/?l=bugtraq&m=125017764422557&w=2
- http://secunia.com/advisories/35685
- http://secunia.com/advisories/36701
- http://support.apple.com/kb/HT3865
- http://www.openwall.com/lists/oss-security/2009/04/01/9
- http://www.openwall.com/lists/oss-security/2009/04/09/1
- http://www.php.net/releases/5_2_9.php