Vulnerabilities > CVE-2010-2100 - Information Exposure vulnerability in PHP
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
PARTIAL Integrity impact
NONE Availability impact
NONE Summary
The (1) htmlentities, (2) htmlspecialchars, (3) str_getcsv, (4) http_build_query, (5) strpbrk, and (6) strtr functions in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function, related to the call time pass by reference feature.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 17 |
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Subverting Environment Variable Values The attacker directly or indirectly modifies environment variables used by or controlling the target software. The attacker's goal is to cause the target software to deviate from its expected operation in a manner that benefits the attacker.
- Footprinting An attacker engages in probing and exploration activity to identify constituents and properties of the target. Footprinting is a general term to describe a variety of information gathering techniques, often used by attackers in preparation for some attack. It consists of using tools to learn as much as possible about the composition, configuration, and security mechanisms of the targeted application, system or network. Information that might be collected during a footprinting effort could include open ports, applications and their versions, network topology, and similar information. While footprinting is not intended to be damaging (although certain activities, such as network scans, can sometimes cause disruptions to vulnerable applications inadvertently) it may often pave the way for more damaging attacks.
- Exploiting Trust in Client (aka Make the Client Invisible) An attack of this type exploits a programs' vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by placing themselves in the communication channel between client and server such that communication directly to the server is possible where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.
- Browser Fingerprinting An attacker carefully crafts small snippets of Java Script to efficiently detect the type of browser the potential victim is using. Many web-based attacks need prior knowledge of the web browser including the version of browser to ensure successful exploitation of a vulnerability. Having this knowledge allows an attacker to target the victim with attacks that specifically exploit known or zero day weaknesses in the type and version of the browser used by the victim. Automating this process via Java Script as a part of the same delivery system used to exploit the browser is considered more efficient as the attacker can supply a browser fingerprinting method and integrate it with exploit code, all contained in Java Script and in response to the same web page request by the browser.
- Session Credential Falsification through Prediction This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.
Nessus
NASL family SuSE Local Security Checks NASL id SUSE_11_1_APACHE2-MOD_PHP5-100928.NASL description PHP was updated to version 5.2.14 to fix several security issues : - [CVE-2010-1860](http://cve.mitre.org/cgi-bin/cvename.cgi?nam e=CVE-2010-1860) - [CVE-2010-1862](http://cve.mitre.org/cgi-bin/cvename.cgi?nam e=CVE-2010-1862) - [CVE-2010-1864](http://cve.mitre.org/cgi-bin/cvename.cgi?nam e=CVE-2010-1864) - [CVE-2010-1914](http://cve.mitre.org/cgi-bin/cvename.cgi?nam e=CVE-2010-1914) - [CVE-2010-1915](http://cve.mitre.org/cgi-bin/cvename.cgi?nam e=CVE-2010-1915) - [CVE-2010-1917](http://cve.mitre.org/cgi-bin/cvename.cgi?nam e=CVE-2010-1917) - [CVE-2010-2093](http://cve.mitre.org/cgi-bin/cvename.cgi?nam e=CVE-2010-2093) - [CVE-2010-2094](http://cve.mitre.org/cgi-bin/cvename.cgi?nam e=CVE-2010-2094) - [CVE-2010-2097](http://cve.mitre.org/cgi-bin/cvename.cgi?nam e=CVE-2010-2097) - [CVE-2010-2100](http://cve.mitre.org/cgi-bin/cvename.cgi?nam e=CVE-2010-2100) - [CVE-2010-2101](http://cve.mitre.org/cgi-bin/cvename.cgi?nam e=CVE-2010-2101) - [CVE-2010-2190](http://cve.mitre.org/cgi-bin/cvename.cgi?nam e=CVE-2010-2190) - [CVE-2010-2191](http://cve.mitre.org/cgi-bin/cvename.cgi?nam e=CVE-2010-2191) - [CVE-2010-2225](http://cve.mitre.org/cgi-bin/cvename.cgi?nam e=CVE-2010-2225) - [CVE-2010-2484](http://cve.mitre.org/cgi-bin/cvename.cgi?nam e=CVE-2010-2484) - [CVE-2010-2531](http://cve.mitre.org/cgi-bin/cvename.cgi?nam e=CVE-2010-2531) - [CVE-2010-3062](http://cve.mitre.org/cgi-bin/cvename.cgi?nam e=CVE-2010-3062) - [CVE-2010-3063](http://cve.mitre.org/cgi-bin/cvename.cgi?nam e=CVE-2010-3063) - [CVE-2010-3064](http://cve.mitre.org/cgi-bin/cvename.cgi?nam e=CVE-2010-3064) - [CVE-2010-3065](http://cve.mitre.org/cgi-bin/cvename.cgi?nam e=CVE-2010-3065) last seen 2020-06-01 modified 2020-06-02 plugin id 49752 published 2010-10-06 reporter This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/49752 title openSUSE Security Update : apache2-mod_php5 (openSUSE-SU-2010:0678-1) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from openSUSE Security Update apache2-mod_php5-3213. # # The text description of this plugin is (C) SUSE LLC. # include("compat.inc"); if (description) { script_id(49752); script_version("1.6"); script_cvs_date("Date: 2019/10/25 13:36:37"); script_cve_id("CVE-2010-1860", "CVE-2010-1862", "CVE-2010-1864", "CVE-2010-1914", "CVE-2010-1915", "CVE-2010-1917", "CVE-2010-2093", "CVE-2010-2094", "CVE-2010-2097", "CVE-2010-2100", "CVE-2010-2101", "CVE-2010-2190", "CVE-2010-2191", "CVE-2010-2225", "CVE-2010-2484", "CVE-2010-2531", "CVE-2010-3062", "CVE-2010-3063", "CVE-2010-3064", "CVE-2010-3065"); script_name(english:"openSUSE Security Update : apache2-mod_php5 (openSUSE-SU-2010:0678-1)"); script_summary(english:"Check for the apache2-mod_php5-3213 patch"); script_set_attribute( attribute:"synopsis", value:"The remote openSUSE host is missing a security update." ); script_set_attribute( attribute:"description", value: "PHP was updated to version 5.2.14 to fix several security issues : - [CVE-2010-1860](http://cve.mitre.org/cgi-bin/cvename.cgi?nam e=CVE-2010-1860) - [CVE-2010-1862](http://cve.mitre.org/cgi-bin/cvename.cgi?nam e=CVE-2010-1862) - [CVE-2010-1864](http://cve.mitre.org/cgi-bin/cvename.cgi?nam e=CVE-2010-1864) - [CVE-2010-1914](http://cve.mitre.org/cgi-bin/cvename.cgi?nam e=CVE-2010-1914) - [CVE-2010-1915](http://cve.mitre.org/cgi-bin/cvename.cgi?nam e=CVE-2010-1915) - [CVE-2010-1917](http://cve.mitre.org/cgi-bin/cvename.cgi?nam e=CVE-2010-1917) - [CVE-2010-2093](http://cve.mitre.org/cgi-bin/cvename.cgi?nam e=CVE-2010-2093) - [CVE-2010-2094](http://cve.mitre.org/cgi-bin/cvename.cgi?nam e=CVE-2010-2094) - [CVE-2010-2097](http://cve.mitre.org/cgi-bin/cvename.cgi?nam e=CVE-2010-2097) - [CVE-2010-2100](http://cve.mitre.org/cgi-bin/cvename.cgi?nam e=CVE-2010-2100) - [CVE-2010-2101](http://cve.mitre.org/cgi-bin/cvename.cgi?nam e=CVE-2010-2101) - [CVE-2010-2190](http://cve.mitre.org/cgi-bin/cvename.cgi?nam e=CVE-2010-2190) - [CVE-2010-2191](http://cve.mitre.org/cgi-bin/cvename.cgi?nam e=CVE-2010-2191) - [CVE-2010-2225](http://cve.mitre.org/cgi-bin/cvename.cgi?nam e=CVE-2010-2225) - [CVE-2010-2484](http://cve.mitre.org/cgi-bin/cvename.cgi?nam e=CVE-2010-2484) - [CVE-2010-2531](http://cve.mitre.org/cgi-bin/cvename.cgi?nam e=CVE-2010-2531) - [CVE-2010-3062](http://cve.mitre.org/cgi-bin/cvename.cgi?nam e=CVE-2010-3062) - [CVE-2010-3063](http://cve.mitre.org/cgi-bin/cvename.cgi?nam e=CVE-2010-3063) - [CVE-2010-3064](http://cve.mitre.org/cgi-bin/cvename.cgi?nam e=CVE-2010-3064) - [CVE-2010-3065](http://cve.mitre.org/cgi-bin/cvename.cgi?nam e=CVE-2010-3065)" ); script_set_attribute( attribute:"see_also", value:"http://cve.mitre.org/cgi-bin/cvename.cgi?nam" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=604315" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=604652" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=604654" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=605097" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=605100" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=609763" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=609766" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=609768" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=609769" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=612555" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=612556" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=616232" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=619469" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=619483" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=619486" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=619487" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=619489" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=633932" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=636923" ); script_set_attribute( attribute:"see_also", value:"https://lists.opensuse.org/opensuse-updates/2010-09/msg00053.html" ); script_set_attribute( attribute:"solution", value:"Update the affected apache2-mod_php5 packages." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:apache2-mod_php5"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-bcmath"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-bz2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-calendar"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-ctype"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-curl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-dba"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-dbase"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-dom"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-exif"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-fastcgi"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-ftp"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-gd"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-gettext"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-gmp"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-hash"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-iconv"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-imap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-json"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-ldap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-mbstring"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-mcrypt"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-mysql"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-ncurses"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-odbc"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-openssl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-pcntl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-pdo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-pear"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-pgsql"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-posix"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-pspell"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-readline"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-shmop"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-snmp"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-soap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-sockets"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-sqlite"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-suhosin"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-sysvmsg"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-sysvsem"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-sysvshm"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-tidy"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-tokenizer"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-wddx"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-xmlreader"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-xmlrpc"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-xmlwriter"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-xsl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-zip"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-zlib"); script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:11.1"); script_set_attribute(attribute:"patch_publication_date", value:"2010/09/28"); script_set_attribute(attribute:"plugin_publication_date", value:"2010/10/06"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/SuSE/release"); if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE"); if (release !~ "^(SUSE11\.1)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "11.1", release); if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); ourarch = get_kb_item("Host/cpu"); if (!ourarch) audit(AUDIT_UNKNOWN_ARCH); if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch); flag = 0; if ( rpm_check(release:"SUSE11.1", reference:"apache2-mod_php5-5.2.14-0.1.1") ) flag++; if ( rpm_check(release:"SUSE11.1", reference:"php5-5.2.14-0.1.1") ) flag++; if ( rpm_check(release:"SUSE11.1", reference:"php5-bcmath-5.2.14-0.1.1") ) flag++; if ( rpm_check(release:"SUSE11.1", reference:"php5-bz2-5.2.14-0.1.1") ) flag++; if ( rpm_check(release:"SUSE11.1", reference:"php5-calendar-5.2.14-0.1.1") ) flag++; if ( rpm_check(release:"SUSE11.1", reference:"php5-ctype-5.2.14-0.1.1") ) flag++; if ( rpm_check(release:"SUSE11.1", reference:"php5-curl-5.2.14-0.1.1") ) flag++; if ( rpm_check(release:"SUSE11.1", reference:"php5-dba-5.2.14-0.1.1") ) flag++; if ( rpm_check(release:"SUSE11.1", reference:"php5-dbase-5.2.14-0.1.1") ) flag++; if ( rpm_check(release:"SUSE11.1", reference:"php5-devel-5.2.14-0.1.1") ) flag++; if ( rpm_check(release:"SUSE11.1", reference:"php5-dom-5.2.14-0.1.1") ) flag++; if ( rpm_check(release:"SUSE11.1", reference:"php5-exif-5.2.14-0.1.1") ) flag++; if ( rpm_check(release:"SUSE11.1", reference:"php5-fastcgi-5.2.14-0.1.1") ) flag++; if ( rpm_check(release:"SUSE11.1", reference:"php5-ftp-5.2.14-0.1.1") ) flag++; if ( rpm_check(release:"SUSE11.1", reference:"php5-gd-5.2.14-0.1.1") ) flag++; if ( rpm_check(release:"SUSE11.1", reference:"php5-gettext-5.2.14-0.1.1") ) flag++; if ( rpm_check(release:"SUSE11.1", reference:"php5-gmp-5.2.14-0.1.1") ) flag++; if ( rpm_check(release:"SUSE11.1", reference:"php5-hash-5.2.14-0.1.1") ) flag++; if ( rpm_check(release:"SUSE11.1", reference:"php5-iconv-5.2.14-0.1.1") ) flag++; if ( rpm_check(release:"SUSE11.1", reference:"php5-imap-5.2.14-0.1.1") ) flag++; if ( rpm_check(release:"SUSE11.1", reference:"php5-json-5.2.14-0.1.1") ) flag++; if ( rpm_check(release:"SUSE11.1", reference:"php5-ldap-5.2.14-0.1.1") ) flag++; if ( rpm_check(release:"SUSE11.1", reference:"php5-mbstring-5.2.14-0.1.1") ) flag++; if ( rpm_check(release:"SUSE11.1", reference:"php5-mcrypt-5.2.14-0.1.1") ) flag++; if ( rpm_check(release:"SUSE11.1", reference:"php5-mysql-5.2.14-0.1.1") ) flag++; if ( rpm_check(release:"SUSE11.1", reference:"php5-ncurses-5.2.14-0.1.1") ) flag++; if ( rpm_check(release:"SUSE11.1", reference:"php5-odbc-5.2.14-0.1.1") ) flag++; if ( rpm_check(release:"SUSE11.1", reference:"php5-openssl-5.2.14-0.1.1") ) flag++; if ( rpm_check(release:"SUSE11.1", reference:"php5-pcntl-5.2.14-0.1.1") ) flag++; if ( rpm_check(release:"SUSE11.1", reference:"php5-pdo-5.2.14-0.1.1") ) flag++; if ( rpm_check(release:"SUSE11.1", reference:"php5-pear-5.2.14-0.1.1") ) flag++; if ( rpm_check(release:"SUSE11.1", reference:"php5-pgsql-5.2.14-0.1.1") ) flag++; if ( rpm_check(release:"SUSE11.1", reference:"php5-posix-5.2.14-0.1.1") ) flag++; if ( rpm_check(release:"SUSE11.1", reference:"php5-pspell-5.2.14-0.1.1") ) flag++; if ( rpm_check(release:"SUSE11.1", reference:"php5-readline-5.2.14-0.1.1") ) flag++; if ( rpm_check(release:"SUSE11.1", reference:"php5-shmop-5.2.14-0.1.1") ) flag++; if ( rpm_check(release:"SUSE11.1", reference:"php5-snmp-5.2.14-0.1.1") ) flag++; if ( rpm_check(release:"SUSE11.1", reference:"php5-soap-5.2.14-0.1.1") ) flag++; if ( rpm_check(release:"SUSE11.1", reference:"php5-sockets-5.2.14-0.1.1") ) flag++; if ( rpm_check(release:"SUSE11.1", reference:"php5-sqlite-5.2.14-0.1.1") ) flag++; if ( rpm_check(release:"SUSE11.1", reference:"php5-suhosin-5.2.14-0.1.1") ) flag++; if ( rpm_check(release:"SUSE11.1", reference:"php5-sysvmsg-5.2.14-0.1.1") ) flag++; if ( rpm_check(release:"SUSE11.1", reference:"php5-sysvsem-5.2.14-0.1.1") ) flag++; if ( rpm_check(release:"SUSE11.1", reference:"php5-sysvshm-5.2.14-0.1.1") ) flag++; if ( rpm_check(release:"SUSE11.1", reference:"php5-tidy-5.2.14-0.1.1") ) flag++; if ( rpm_check(release:"SUSE11.1", reference:"php5-tokenizer-5.2.14-0.1.1") ) flag++; if ( rpm_check(release:"SUSE11.1", reference:"php5-wddx-5.2.14-0.1.1") ) flag++; if ( rpm_check(release:"SUSE11.1", reference:"php5-xmlreader-5.2.14-0.1.1") ) flag++; if ( rpm_check(release:"SUSE11.1", reference:"php5-xmlrpc-5.2.14-0.1.1") ) flag++; if ( rpm_check(release:"SUSE11.1", reference:"php5-xmlwriter-5.2.14-0.1.1") ) flag++; if ( rpm_check(release:"SUSE11.1", reference:"php5-xsl-5.2.14-0.1.1") ) flag++; if ( rpm_check(release:"SUSE11.1", reference:"php5-zip-5.2.14-0.1.1") ) flag++; if ( rpm_check(release:"SUSE11.1", reference:"php5-zlib-5.2.14-0.1.1") ) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get()); else security_hole(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "apache2-mod_php5 / php5 / php5-bcmath / php5-bz2 / php5-calendar / etc"); }NASL family SuSE Local Security Checks NASL id SUSE_11_3_APACHE2-MOD_PHP5-100812.NASL description PHP was updated to version 5.3.3 to fix serveral security issues. (CVE-2010-0397, CVE-2010-1860, CVE-2010-1862, CVE-2010-1864, CVE-2010-1866, CVE-2010-1914, CVE-2010-1915, CVE-2010-1917, CVE-2010-2093, CVE-2010-2094, CVE-2010-2097, CVE-2010-2100, CVE-2010-2101, CVE-2010-2190, CVE-2010-2191, CVE-2010-2225, CVE-2010-2531, CVE-2010-2950, CVE-2010-3062, CVE-2010-3063, CVE-2010-3064, CVE-2010-3065) last seen 2020-06-01 modified 2020-06-02 plugin id 75429 published 2014-06-13 reporter This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/75429 title openSUSE Security Update : apache2-mod_php5 (openSUSE-SU-2010:0599-1) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from openSUSE Security Update apache2-mod_php5-2929. # # The text description of this plugin is (C) SUSE LLC. # include("compat.inc"); if (description) { script_id(75429); script_version("1.4"); script_cvs_date("Date: 2019/10/25 13:36:39"); script_cve_id("CVE-2010-0397", "CVE-2010-1860", "CVE-2010-1862", "CVE-2010-1864", "CVE-2010-1866", "CVE-2010-1914", "CVE-2010-1915", "CVE-2010-1917", "CVE-2010-2093", "CVE-2010-2094", "CVE-2010-2097", "CVE-2010-2100", "CVE-2010-2101", "CVE-2010-2190", "CVE-2010-2191", "CVE-2010-2225", "CVE-2010-2531", "CVE-2010-2950", "CVE-2010-3062", "CVE-2010-3063", "CVE-2010-3064", "CVE-2010-3065"); script_name(english:"openSUSE Security Update : apache2-mod_php5 (openSUSE-SU-2010:0599-1)"); script_summary(english:"Check for the apache2-mod_php5-2929 patch"); script_set_attribute( attribute:"synopsis", value:"The remote openSUSE host is missing a security update." ); script_set_attribute( attribute:"description", value: "PHP was updated to version 5.3.3 to fix serveral security issues. (CVE-2010-0397, CVE-2010-1860, CVE-2010-1862, CVE-2010-1864, CVE-2010-1866, CVE-2010-1914, CVE-2010-1915, CVE-2010-1917, CVE-2010-2093, CVE-2010-2094, CVE-2010-2097, CVE-2010-2100, CVE-2010-2101, CVE-2010-2190, CVE-2010-2191, CVE-2010-2225, CVE-2010-2531, CVE-2010-2950, CVE-2010-3062, CVE-2010-3063, CVE-2010-3064, CVE-2010-3065)" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=588975" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=604315" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=604652" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=604654" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=604656" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=605097" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=605100" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=609763" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=609766" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=609768" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=609769" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=612555" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=612556" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=616232" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=619483" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=619486" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=619487" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=619489" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=633932" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=633934" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=636923" ); script_set_attribute( attribute:"see_also", value:"https://lists.opensuse.org/opensuse-updates/2010-09/msg00013.html" ); script_set_attribute( attribute:"solution", value:"Update the affected apache2-mod_php5 packages." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:apache2-mod_php5"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-bcmath"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-bz2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-calendar"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-ctype"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-curl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-dba"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-dom"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-enchant"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-exif"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-fastcgi"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-fileinfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-ftp"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-gd"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-gettext"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-gmp"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-hash"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-iconv"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-imap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-intl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-json"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-ldap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-mbstring"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-mcrypt"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-mysql"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-odbc"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-openssl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-pcntl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-pdo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-pear"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-pgsql"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-phar"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-posix"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-pspell"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-readline"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-shmop"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-snmp"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-soap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-sockets"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-sqlite"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-suhosin"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-sysvmsg"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-sysvsem"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-sysvshm"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-tidy"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-tokenizer"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-wddx"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-xmlreader"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-xmlrpc"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-xmlwriter"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-xsl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-zip"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-zlib"); script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:11.3"); script_set_attribute(attribute:"patch_publication_date", value:"2010/08/12"); script_set_attribute(attribute:"plugin_publication_date", value:"2014/06/13"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/SuSE/release"); if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE"); if (release !~ "^(SUSE11\.3)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "11.3", release); if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); ourarch = get_kb_item("Host/cpu"); if (!ourarch) audit(AUDIT_UNKNOWN_ARCH); if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch); flag = 0; if ( rpm_check(release:"SUSE11.3", reference:"apache2-mod_php5-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-bcmath-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-bz2-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-calendar-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-ctype-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-curl-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-dba-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-devel-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-dom-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-enchant-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-exif-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-fastcgi-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-fileinfo-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-ftp-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-gd-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-gettext-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-gmp-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-hash-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-iconv-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-imap-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-intl-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-json-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-ldap-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-mbstring-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-mcrypt-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-mysql-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-odbc-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-openssl-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-pcntl-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-pdo-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-pear-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-pgsql-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-phar-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-posix-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-pspell-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-readline-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-shmop-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-snmp-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-soap-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-sockets-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-sqlite-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-suhosin-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-sysvmsg-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-sysvsem-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-sysvshm-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-tidy-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-tokenizer-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-wddx-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-xmlreader-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-xmlrpc-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-xmlwriter-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-xsl-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-zip-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-zlib-5.3.3-0.1.2") ) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get()); else security_hole(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "apache2-mod_php5 / php5 / php5-bcmath / php5-bz2 / php5-calendar / etc"); }NASL family SuSE Local Security Checks NASL id SUSE_APACHE2-MOD_PHP5-7110.NASL description PHP was updated to version 5.2.14 to fix serveral security issues : - CVE-2010-1860 - CVE-2010-1862 - CVE-2010-1864 - CVE-2010-1914 - CVE-2010-1915 - CVE-2010-1917 - CVE-2010-2093 - CVE-2010-2094 - CVE-2010-2097 - CVE-2010-2100 - CVE-2010-2101 - CVE-2010-2190 - CVE-2010-2191 - CVE-2010-2225 - CVE-2010-2484 - CVE-2010-2531 - CVE-2010-3062 - CVE-2010-3063 - CVE-2010-3064 - CVE-2010-3065 last seen 2020-06-01 modified 2020-06-02 plugin id 49830 published 2010-10-11 reporter This script is Copyright (C) 2010-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/49830 title SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 7110) NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-201110-06.NASL description The remote host is affected by the vulnerability described in GLSA-201110-06 (PHP: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in PHP. Please review the CVE identifiers referenced below for details. Impact : A context-dependent attacker could execute arbitrary code, obtain sensitive information from process memory, bypass intended access restrictions, or cause a Denial of Service in various ways. A remote attacker could cause a Denial of Service in various ways, bypass spam detections, or bypass open_basedir restrictions. Workaround : There is no known workaround at this time. last seen 2020-06-01 modified 2020-06-02 plugin id 56459 published 2011-10-12 reporter This script is Copyright (C) 2011-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/56459 title GLSA-201110-06 : PHP: Multiple vulnerabilities NASL family SuSE Local Security Checks NASL id SUSE_11_APACHE2-MOD_PHP5-100805.NASL description PHP was updated to version 5.2.14 to fix serveral security issues : - CVE-2010-1860 - CVE-2010-1862 - CVE-2010-1864 - CVE-2010-1914 - CVE-2010-1915 - CVE-2010-1917 - CVE-2010-2093 - CVE-2010-2094 - CVE-2010-2097 - CVE-2010-2100 - CVE-2010-2101 - CVE-2010-2190 - CVE-2010-2191 - CVE-2010-2225 - CVE-2010-2484 - CVE-2010-2531 - CVE-2010-3062 - CVE-2010-3063 - CVE-2010-3064 - CVE-2010-3065 last seen 2020-06-01 modified 2020-06-02 plugin id 50890 published 2010-12-02 reporter This script is Copyright (C) 2010-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/50890 title SuSE 11 / 11.1 Security Update : Apache 2 (SAT Patch Numbers 2880 / 2881) NASL family SuSE Local Security Checks NASL id SUSE_11_2_APACHE2-MOD_PHP5-100813.NASL description PHP was updated to version 5.3.3 to fix serveral security issues. (CVE-2010-0397, CVE-2010-1860, CVE-2010-1862, CVE-2010-1864, CVE-2010-1866, CVE-2010-1914, CVE-2010-1915, CVE-2010-1917, CVE-2010-2093, CVE-2010-2094, CVE-2010-2097, CVE-2010-2100, CVE-2010-2101, CVE-2010-2190, CVE-2010-2191, CVE-2010-2225, CVE-2010-2531, CVE-2010-2950, CVE-2010-3062, CVE-2010-3063, CVE-2010-3064, CVE-2010-3065) last seen 2020-06-01 modified 2020-06-02 plugin id 49210 published 2010-09-13 reporter This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/49210 title openSUSE Security Update : apache2-mod_php5 (openSUSE-SU-2010:0599-1) NASL family CGI abuses NASL id PHP_5_3_3.NASL description According to its banner, the version of PHP 5.3 installed on the remote host is older than 5.3.3. Such versions may be affected by several security issues : - An error exists when processing invalid XML-RPC requests that can lead to a NULL pointer dereference. (bug #51288) (CVE-2010-0397) - An error exists in the function last seen 2020-06-01 modified 2020-06-02 plugin id 48245 published 2010-08-04 reporter This script is Copyright (C) 2010-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/48245 title PHP 5.3 < 5.3.3 Multiple Vulnerabilities NASL family CGI abuses NASL id PHP_5_2_14.NASL description According to its banner, the version of PHP 5.2 installed on the remote host is older than 5.2.14. Such versions may be affected by several security issues : - An error exists when processing invalid XML-RPC requests that can lead to a NULL pointer dereference. (bug #51288) (CVE-2010-0397) - An error exists in the function last seen 2020-06-01 modified 2020-06-02 plugin id 48244 published 2010-08-04 reporter This script is Copyright (C) 2010-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/48244 title PHP 5.2 < 5.2.14 Multiple Vulnerabilities
Seebug
bulletinFamily exploit description CVE ID: CVE-2010-2100 PHP是广泛使用的通用目的脚本语言，特别适合于Web开发，可嵌入到HTML中。 PHP的htmlentities()及htmlspecialchars()函数中存在信息泄露漏洞： static void php_html_entities(INTERNAL_FUNCTION_PARAMETERS, int all) { char *str, *hint_charset = NULL; int str_len, hint_charset_len = 0; int len; long quote_style = ENT_COMPAT; char *replaced; zend_bool double_encode = 1; if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|ls!b", &str, &str_len, &quote_style, &hint_charset, &hint_charset_len, &double_encode) == FAILURE) { return; } replaced = php_escape_html_entities_ex(str, str_len, &len, all, quote_style, hint_charset, double_encode TSRMLS_CC); RETVAL_STRINGL(replaced, len, 0); } zend_parse_parameters()函数将4个参数拷贝到了本地变量，破坏了这些变量与原始ZVAL之间的联系。问题是任何对ZVAL的修改都不会反映在本地变量上，因此任何中断都可能修改ZVAL，导致本地变量指向已释放和重新使用的内存。此外由于 zend_parse_parameters()支持对象的__toString()方式，只要以 htmlentities()/htmlspecialchars()第三个参数的形式传送对象就可以中断参数解析。由于PHP的call time pass by reference功能，之后攻击者可以从__toString()方式杀死第一个参数并重新用于哈希表。这导致 php_escape_html_entities_ex()作用于哈希表的内存而不是字符串的内存，攻击者可以泄露重要的内部内存偏移。 PHP PHP <= 5.3.2 PHP PHP <= 5.2.13 临时解决方法： * 禁用call time pass by reference功能。 厂商补丁： PHP --- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.php.net id SSV:19718 last seen 2017-11-19 modified 2010-05-31 published 2010-05-31 reporter Root source https://www.seebug.org/vuldb/ssvid-19718 title PHP htmlentities()和htmlspecialchars()函数中断处理地址信息泄露漏洞 bulletinFamily exploit description CVE ID: CVE-2010-2100 PHP是广泛使用的通用目的脚本语言，特别适合于Web开发，可嵌入到HTML中。 PHP的str_getcsv()函数中存在信息泄露漏洞： PHP_FUNCTION(str_getcsv) { char *str, delim = ',', enc = '"', esc = '\'; char *delim_str = NULL, *enc_str = NULL, *esc_str = NULL; int str_len = 0, delim_len = 0, enc_len = 0, esc_len = 0; if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|sss", &str, &str_len, &delim_str, &delim_len, &enc_str, &enc_len, &esc_str, &esc_len) == FAILURE) { return; } delim = delim_len ? delim_str[0] : delim; enc = enc_len ? enc_str[0] : enc; esc = esc_len ? esc_str[0] : esc; php_fgetcsv(NULL, delim, enc, esc, str_len, str, return_value TSRMLS_CC); } zend_parse_parameters()函数将4个参数拷贝到了本地变量，破坏了这些变量与原始ZVAL之间的联系。问题是字符串指针仍指向与原始字符串ZVAL完全相同的字符串，如果原始字符串ZVAL已被修改，就会导致字符串指针无效，指向已释放的且被重用的内存。此外由于 zend_parse_parameters()支持对象的__toString()方式，只要以str_getcsv()的第二、第三或第四个参数的形式传送对象就可以中断参数解析。由于PHP的call time pass by reference功能，之后攻击者可以从__toString()方式杀死第一个参数并重新用于哈希表。这导致php_fgetcsv()作用于哈希表的内存而不是字符串的内存，攻击者可以泄露重要的内部内存偏移。 PHP <= 5.3.2 PHP <= 5.2.13 临时解决方法： * 禁用call time pass by reference功能。 厂商补丁： PHP --- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.php.net id SSV:19717 last seen 2017-11-19 modified 2010-05-31 published 2010-05-31 reporter Root source https://www.seebug.org/vuldb/ssvid-19717 title PHP str_getcsv()函数中断处理地址信息泄露漏洞 bulletinFamily exploit description CVE ID: CVE-2010-2100 PHP是广泛使用的通用目的脚本语言，特别适合于Web开发，可嵌入到HTML中。 PHP的http_build_query()函数中存在信息泄露漏洞： PHP_FUNCTION(http_build_query) { zval *formdata; char *prefix = NULL, *arg_sep=NULL; int arg_sep_len = 0, prefix_len = 0; smart_str formstr = {0}; if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "z|ss", &formdata, &prefix, &prefix_len, &arg_sep, &arg_sep_len) != SUCCESS) { RETURN_FALSE; } if (Z_TYPE_P(formdata) != IS_ARRAY && Z_TYPE_P(formdata) != IS_OBJECT) { php_error_docref(NULL TSRMLS_CC, E_WARNING, "Parameter 1 expected to be Array or Object. Incorrect value given"); RETURN_FALSE; } if (php_url_encode_hash_ex(HASH_OF(formdata), &formstr, prefix, prefix_len, NULL, 0, NULL, 0, (Z_TYPE_P(formdata) == IS_OBJECT ? formdata : NULL), arg_sep TSRMLS_CC) == FAILURE) { if (formstr.c) { efree(formstr.c); } RETURN_FALSE; } if (!formstr.c) { RETURN_EMPTY_STRING(); } smart_str_0(&formstr); RETURN_STRINGL(formstr.c, formstr.len, 0); } zend_parse_parameters()函数将4个参数拷贝到了本地变量，破坏了这些变量与原始ZVAL之间的联系。问题是字符串指针仍指向与原始字符串ZVAL完全相同的字符串，如果原始字符串ZVAL已被修改，就会导致字符串指针无效，指向已释放的且被重用的内存。此外由于 zend_parse_parameters()支持对象的__toString()方式，只要以http_build_query()的第三个参数的形式传送对象就可以中断参数解析。由于PHP的call time pass by reference功能，之后攻击者可以从__toString()方式杀死第二个参数并重新用于哈希表。这导致 php_url_encode_hash_ex()作用于哈希表的内存而不是字符串的内存，攻击者可以泄露重要的内部内存偏移。 PHP <= 5.3.2 PHP <= 5.2.13 临时解决方法： * 禁用call time pass by reference功能。 厂商补丁： PHP --- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.php.net id SSV:19716 last seen 2017-11-19 modified 2010-05-31 published 2010-05-31 reporter Root source https://www.seebug.org/vuldb/ssvid-19716 title PHP http_build_query()函数中断处理地址信息泄露漏洞 bulletinFamily exploit description CVE ID: CVE-2010-2101 CVE ID: CVE-2010-2100 PHP是广泛使用的通用目的脚本语言，特别适合于Web开发，可嵌入到HTML中。 PHP的str_pad()函数、str_word_count()函数、wordwrap()函数、strtok()函数、setcookie()函数、strip_tags()函数、strtr()函数中存在信息泄露漏洞 PHP <= 5.3.2 PHP <= 5.2.13 临时解决方法： * 禁用call time pass by reference功能。 厂商补丁： PHP --- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.php.net id SSV:19722 last seen 2017-11-19 modified 2010-06-01 published 2010-06-01 reporter Root source https://www.seebug.org/vuldb/ssvid-19722 title PHP 多个函数中断处理地址信息泄露漏洞
References
- http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html
- http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00000.html
- http://marc.info/?l=bugtraq&m=133469208622507&w=2
- http://php-security.org/2010/05/21/mops-2010-036-php-htmlentities-and-htmlspecialchars-interruption-information-leak-vulnerability/index.html
- http://php-security.org/2010/05/21/mops-2010-037-php-str_getcsv-interruption-information-leak-vulnerability/index.html
- http://php-security.org/2010/05/21/mops-2010-038-php-http_build_query-interruption-information-leak-vulnerability/index.html
- http://php-security.org/2010/05/21/mops-2010-039-php-strpbrk-interruption-information-leak-vulnerability/index.html
- http://php-security.org/2010/05/21/mops-2010-040-php-strtr-interruption-information-leak-vulnerability/index.html