Vulnerabilities > CVE-2010-2950 - USE of Externally-Controlled Format String vulnerability in PHP
Attack vector
NETWORK Attack complexity
MEDIUM Privileges required
NONE Confidentiality impact
PARTIAL Integrity impact
PARTIAL Availability impact
PARTIAL Summary
Format string vulnerability in stream.c in the phar extension in PHP 5.3.x through 5.3.3 allows context-dependent attackers to obtain sensitive information (memory contents) and possibly execute arbitrary code via a crafted phar:// URI that is not properly handled by the phar_stream_flush function, leading to errors in the php_stream_wrapper_log_error function. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-2094.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 4 |
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Format String Injection An attacker includes formatting characters in a string input field on the target application. Most applications assume that users will provide static text and may respond unpredictably to the presence of formatting character. For example, in certain functions of the C programming languages such as printf, the formatting character %s will print the contents of a memory location expecting this location to identify a string and the formatting character %n prints the number of DWORD written in the memory. An attacker can use this to read or write to memory locations or files, or simply to manipulate the value of the resulting text in unexpected ways. Reading or writing memory may result in program crashes and writing memory could result in the execution of arbitrary code if the attacker can write to the program stack.
- String Format Overflow in syslog() This attack targets the format string vulnerabilities in the syslog() function. An attacker would typically inject malicious input in the format string parameter of the syslog function. This is a common problem, and many public vulnerabilities and associated exploits have been posted.
Nessus
NASL family SuSE Local Security Checks NASL id SUSE_11_3_APACHE2-MOD_PHP5-100812.NASL description PHP was updated to version 5.3.3 to fix serveral security issues. (CVE-2010-0397, CVE-2010-1860, CVE-2010-1862, CVE-2010-1864, CVE-2010-1866, CVE-2010-1914, CVE-2010-1915, CVE-2010-1917, CVE-2010-2093, CVE-2010-2094, CVE-2010-2097, CVE-2010-2100, CVE-2010-2101, CVE-2010-2190, CVE-2010-2191, CVE-2010-2225, CVE-2010-2531, CVE-2010-2950, CVE-2010-3062, CVE-2010-3063, CVE-2010-3064, CVE-2010-3065) last seen 2020-06-01 modified 2020-06-02 plugin id 75429 published 2014-06-13 reporter This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/75429 title openSUSE Security Update : apache2-mod_php5 (openSUSE-SU-2010:0599-1) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from openSUSE Security Update apache2-mod_php5-2929. # # The text description of this plugin is (C) SUSE LLC. # include("compat.inc"); if (description) { script_id(75429); script_version("1.4"); script_cvs_date("Date: 2019/10/25 13:36:39"); script_cve_id("CVE-2010-0397", "CVE-2010-1860", "CVE-2010-1862", "CVE-2010-1864", "CVE-2010-1866", "CVE-2010-1914", "CVE-2010-1915", "CVE-2010-1917", "CVE-2010-2093", "CVE-2010-2094", "CVE-2010-2097", "CVE-2010-2100", "CVE-2010-2101", "CVE-2010-2190", "CVE-2010-2191", "CVE-2010-2225", "CVE-2010-2531", "CVE-2010-2950", "CVE-2010-3062", "CVE-2010-3063", "CVE-2010-3064", "CVE-2010-3065"); script_name(english:"openSUSE Security Update : apache2-mod_php5 (openSUSE-SU-2010:0599-1)"); script_summary(english:"Check for the apache2-mod_php5-2929 patch"); script_set_attribute( attribute:"synopsis", value:"The remote openSUSE host is missing a security update." ); script_set_attribute( attribute:"description", value: "PHP was updated to version 5.3.3 to fix serveral security issues. (CVE-2010-0397, CVE-2010-1860, CVE-2010-1862, CVE-2010-1864, CVE-2010-1866, CVE-2010-1914, CVE-2010-1915, CVE-2010-1917, CVE-2010-2093, CVE-2010-2094, CVE-2010-2097, CVE-2010-2100, CVE-2010-2101, CVE-2010-2190, CVE-2010-2191, CVE-2010-2225, CVE-2010-2531, CVE-2010-2950, CVE-2010-3062, CVE-2010-3063, CVE-2010-3064, CVE-2010-3065)" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=588975" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=604315" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=604652" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=604654" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=604656" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=605097" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=605100" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=609763" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=609766" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=609768" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=609769" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=612555" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=612556" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=616232" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=619483" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=619486" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=619487" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=619489" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=633932" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=633934" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=636923" ); script_set_attribute( attribute:"see_also", value:"https://lists.opensuse.org/opensuse-updates/2010-09/msg00013.html" ); script_set_attribute( attribute:"solution", value:"Update the affected apache2-mod_php5 packages." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:apache2-mod_php5"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-bcmath"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-bz2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-calendar"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-ctype"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-curl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-dba"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-dom"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-enchant"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-exif"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-fastcgi"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-fileinfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-ftp"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-gd"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-gettext"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-gmp"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-hash"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-iconv"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-imap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-intl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-json"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-ldap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-mbstring"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-mcrypt"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-mysql"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-odbc"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-openssl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-pcntl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-pdo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-pear"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-pgsql"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-phar"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-posix"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-pspell"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-readline"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-shmop"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-snmp"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-soap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-sockets"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-sqlite"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-suhosin"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-sysvmsg"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-sysvsem"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-sysvshm"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-tidy"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-tokenizer"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-wddx"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-xmlreader"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-xmlrpc"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-xmlwriter"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-xsl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-zip"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:php5-zlib"); script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:11.3"); script_set_attribute(attribute:"patch_publication_date", value:"2010/08/12"); script_set_attribute(attribute:"plugin_publication_date", value:"2014/06/13"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/SuSE/release"); if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE"); if (release !~ "^(SUSE11\.3)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "11.3", release); if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); ourarch = get_kb_item("Host/cpu"); if (!ourarch) audit(AUDIT_UNKNOWN_ARCH); if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch); flag = 0; if ( rpm_check(release:"SUSE11.3", reference:"apache2-mod_php5-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-bcmath-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-bz2-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-calendar-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-ctype-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-curl-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-dba-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-devel-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-dom-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-enchant-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-exif-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-fastcgi-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-fileinfo-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-ftp-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-gd-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-gettext-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-gmp-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-hash-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-iconv-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-imap-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-intl-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-json-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-ldap-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-mbstring-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-mcrypt-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-mysql-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-odbc-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-openssl-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-pcntl-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-pdo-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-pear-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-pgsql-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-phar-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-posix-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-pspell-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-readline-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-shmop-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-snmp-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-soap-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-sockets-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-sqlite-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-suhosin-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-sysvmsg-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-sysvsem-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-sysvshm-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-tidy-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-tokenizer-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-wddx-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-xmlreader-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-xmlrpc-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-xmlwriter-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-xsl-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-zip-5.3.3-0.1.2") ) flag++; if ( rpm_check(release:"SUSE11.3", reference:"php5-zlib-5.3.3-0.1.2") ) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get()); else security_hole(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "apache2-mod_php5 / php5 / php5-bcmath / php5-bz2 / php5-calendar / etc"); }NASL family Scientific Linux Local Security Checks NASL id SL_20120627_PHP_ON_SL6_X.NASL description PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was discovered that the PHP XSL extension did not restrict the file writing capability of libxslt. A remote attacker could use this flaw to create or overwrite an arbitrary file that is writable by the user running PHP, if a PHP script processed untrusted eXtensible Style Sheet Language Transformations (XSLT) content. (CVE-2012-0057) Note: This update disables file writing by default. A new PHP configuration directive, last seen 2020-03-18 modified 2012-08-01 plugin id 61358 published 2012-08-01 reporter This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/61358 title Scientific Linux Security Update : php on SL6.x i386/x86_64 (20120627) code # # (C) Tenable Network Security, Inc. # # The descriptive text is (C) Scientific Linux. # include("compat.inc"); if (description) { script_id(61358); script_version("1.11"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/02/27"); script_cve_id("CVE-2010-2950", "CVE-2011-4153", "CVE-2012-0057", "CVE-2012-0781", "CVE-2012-0789", "CVE-2012-1172", "CVE-2012-2143", "CVE-2012-2336", "CVE-2012-2386"); script_xref(name:"TRA", value:"TRA-2012-01"); script_name(english:"Scientific Linux Security Update : php on SL6.x i386/x86_64 (20120627)"); script_summary(english:"Checks rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value: "The remote Scientific Linux host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was discovered that the PHP XSL extension did not restrict the file writing capability of libxslt. A remote attacker could use this flaw to create or overwrite an arbitrary file that is writable by the user running PHP, if a PHP script processed untrusted eXtensible Style Sheet Language Transformations (XSLT) content. (CVE-2012-0057) Note: This update disables file writing by default. A new PHP configuration directive, 'xsl.security_prefs', can be used to enable file writing in XSLT. A flaw was found in the way PHP validated file names in file upload requests. A remote attacker could possibly use this flaw to bypass the sanitization of the uploaded file names, and cause a PHP script to store the uploaded file in an unexpected directory, by using a directory traversal attack. (CVE-2012-1172) Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in the way the PHP phar extension processed certain fields of tar archive files. A remote attacker could provide a specially crafted tar archive file that, when processed by a PHP application using the phar extension, could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running PHP. (CVE-2012-2386) A format string flaw was found in the way the PHP phar extension processed certain PHAR files. A remote attacker could provide a specially crafted PHAR file, which once processed in a PHP application using the phar extension, could lead to information disclosure and possibly arbitrary code execution via a crafted phar:// URI. (CVE-2010-2950) A flaw was found in the DES algorithm implementation in the crypt() password hashing function in PHP. If the password string to be hashed contained certain characters, the remainder of the string was ignored when calculating the hash, significantly reducing the password strength. (CVE-2012-2143) Note: With this update, passwords are no longer truncated when performing DES hashing. Therefore, new hashes of the affected passwords will not match stored hashes generated using vulnerable PHP versions, and will need to be updated. It was discovered that the fix for CVE-2012-1823, released via a previous update, did not properly filter all php-cgi command line arguments. A specially crafted request to a PHP script could cause the PHP interpreter to execute the script in a loop, or output usage information that triggers an Internal Server Error. (CVE-2012-2336) A memory leak flaw was found in the PHP strtotime() function call. A remote attacker could possibly use this flaw to cause excessive memory consumption by triggering many strtotime() function calls. (CVE-2012-0789) A NULL pointer dereference flaw was found in the PHP tidy_diagnose() function. A remote attacker could use specially crafted input to crash an application that uses tidy::diagnose. (CVE-2012-0781) It was found that PHP did not check the zend_strndup() function's return value in certain cases. A remote attacker could possibly use this flaw to crash a PHP application. (CVE-2011-4153) All php users should upgrade to these updated packages, which contain backported patches to resolve these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect." ); # https://listserv.fnal.gov/scripts/wa.exe?A2=ind1207&L=scientific-linux-errata&T=0&P=2427 script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?055113e5" ); script_set_attribute( attribute:"see_also", value:"https://www.tenable.com/security/research/tra-2012-01" ); script_set_attribute(attribute:"solution", value:"Update the affected packages."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"exploited_by_malware", value:"true"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-bcmath"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-cli"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-common"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-dba"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-embedded"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-enchant"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-gd"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-imap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-intl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-ldap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-mbstring"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-mysql"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-odbc"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-pdo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-pgsql"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-process"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-pspell"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-recode"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-snmp"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-soap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-tidy"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-xml"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-xmlrpc"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-zts"); script_set_attribute(attribute:"cpe", value:"x-cpe:/o:fermilab:scientific_linux"); script_set_attribute(attribute:"vuln_publication_date", value:"2010/09/28"); script_set_attribute(attribute:"patch_publication_date", value:"2012/06/27"); script_set_attribute(attribute:"plugin_publication_date", value:"2012/08/01"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Scientific Linux Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/RedHat/release", "Host/RedHat/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("misc_func.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/RedHat/release"); if (isnull(release) || "Scientific Linux " >!< release) audit(AUDIT_HOST_NOT, "running Scientific Linux"); os_ver = pregmatch(pattern: "Scientific Linux.*release ([0-9]+(\.[0-9]+)?)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Scientific Linux"); os_ver = os_ver[1]; if (! preg(pattern:"^6([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Scientific Linux 6.x", "Scientific Linux " + os_ver); if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if (cpu >!< "x86_64" && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Scientific Linux", cpu); flag = 0; if (rpm_check(release:"SL6", reference:"php-5.3.3-14.el6_3")) flag++; if (rpm_check(release:"SL6", reference:"php-bcmath-5.3.3-14.el6_3")) flag++; if (rpm_check(release:"SL6", reference:"php-cli-5.3.3-14.el6_3")) flag++; if (rpm_check(release:"SL6", reference:"php-common-5.3.3-14.el6_3")) flag++; if (rpm_check(release:"SL6", reference:"php-dba-5.3.3-14.el6_3")) flag++; if (rpm_check(release:"SL6", reference:"php-debuginfo-5.3.3-14.el6_3")) flag++; if (rpm_check(release:"SL6", reference:"php-devel-5.3.3-14.el6_3")) flag++; if (rpm_check(release:"SL6", reference:"php-embedded-5.3.3-14.el6_3")) flag++; if (rpm_check(release:"SL6", reference:"php-enchant-5.3.3-14.el6_3")) flag++; if (rpm_check(release:"SL6", reference:"php-gd-5.3.3-14.el6_3")) flag++; if (rpm_check(release:"SL6", reference:"php-imap-5.3.3-14.el6_3")) flag++; if (rpm_check(release:"SL6", reference:"php-intl-5.3.3-14.el6_3")) flag++; if (rpm_check(release:"SL6", reference:"php-ldap-5.3.3-14.el6_3")) flag++; if (rpm_check(release:"SL6", reference:"php-mbstring-5.3.3-14.el6_3")) flag++; if (rpm_check(release:"SL6", reference:"php-mysql-5.3.3-14.el6_3")) flag++; if (rpm_check(release:"SL6", reference:"php-odbc-5.3.3-14.el6_3")) flag++; if (rpm_check(release:"SL6", reference:"php-pdo-5.3.3-14.el6_3")) flag++; if (rpm_check(release:"SL6", reference:"php-pgsql-5.3.3-14.el6_3")) flag++; if (rpm_check(release:"SL6", reference:"php-process-5.3.3-14.el6_3")) flag++; if (rpm_check(release:"SL6", reference:"php-pspell-5.3.3-14.el6_3")) flag++; if (rpm_check(release:"SL6", reference:"php-recode-5.3.3-14.el6_3")) flag++; if (rpm_check(release:"SL6", reference:"php-snmp-5.3.3-14.el6_3")) flag++; if (rpm_check(release:"SL6", reference:"php-soap-5.3.3-14.el6_3")) flag++; if (rpm_check(release:"SL6", reference:"php-tidy-5.3.3-14.el6_3")) flag++; if (rpm_check(release:"SL6", reference:"php-xml-5.3.3-14.el6_3")) flag++; if (rpm_check(release:"SL6", reference:"php-xmlrpc-5.3.3-14.el6_3")) flag++; if (rpm_check(release:"SL6", reference:"php-zts-5.3.3-14.el6_3")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_HOLE, extra : rpm_report_get() ); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "php / php-bcmath / php-cli / php-common / php-dba / php-debuginfo / etc"); }NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2012-1047.NASL description Updated php53 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was discovered that the PHP XSL extension did not restrict the file writing capability of libxslt. A remote attacker could use this flaw to create or overwrite an arbitrary file that is writable by the user running PHP, if a PHP script processed untrusted eXtensible Style Sheet Language Transformations (XSLT) content. (CVE-2012-0057) Note: This update disables file writing by default. A new PHP configuration directive, last seen 2020-06-01 modified 2020-06-02 plugin id 59753 published 2012-06-28 reporter This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/59753 title RHEL 5 : php53 (RHSA-2012:1047) code # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Red Hat Security Advisory RHSA-2012:1047. The text # itself is copyright (C) Red Hat, Inc. # include("compat.inc"); if (description) { script_id(59753); script_version ("1.24"); script_cvs_date("Date: 2019/10/24 15:35:35"); script_cve_id("CVE-2010-2950", "CVE-2011-4153", "CVE-2012-0057", "CVE-2012-0789", "CVE-2012-1172", "CVE-2012-2143", "CVE-2012-2336", "CVE-2012-2386"); script_bugtraq_id(40173, 47545, 53729); script_xref(name:"RHSA", value:"2012:1047"); script_xref(name:"TRA", value:"TRA-2012-01"); script_name(english:"RHEL 5 : php53 (RHSA-2012:1047)"); script_summary(english:"Checks the rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value:"The remote Red Hat host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "Updated php53 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was discovered that the PHP XSL extension did not restrict the file writing capability of libxslt. A remote attacker could use this flaw to create or overwrite an arbitrary file that is writable by the user running PHP, if a PHP script processed untrusted eXtensible Style Sheet Language Transformations (XSLT) content. (CVE-2012-0057) Note: This update disables file writing by default. A new PHP configuration directive, 'xsl.security_prefs', can be used to enable file writing in XSLT. A flaw was found in the way PHP validated file names in file upload requests. A remote attacker could possibly use this flaw to bypass the sanitization of the uploaded file names, and cause a PHP script to store the uploaded file in an unexpected directory, by using a directory traversal attack. (CVE-2012-1172) Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in the way the PHP phar extension processed certain fields of tar archive files. A remote attacker could provide a specially crafted tar archive file that, when processed by a PHP application using the phar extension, could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running PHP. (CVE-2012-2386) A format string flaw was found in the way the PHP phar extension processed certain PHAR files. A remote attacker could provide a specially crafted PHAR file, which once processed in a PHP application using the phar extension, could lead to information disclosure and possibly arbitrary code execution via a crafted phar:// URI. (CVE-2010-2950) A flaw was found in the DES algorithm implementation in the crypt() password hashing function in PHP. If the password string to be hashed contained certain characters, the remainder of the string was ignored when calculating the hash, significantly reducing the password strength. (CVE-2012-2143) Note: With this update, passwords are no longer truncated when performing DES hashing. Therefore, new hashes of the affected passwords will not match stored hashes generated using vulnerable PHP versions, and will need to be updated. It was discovered that the fix for CVE-2012-1823, released via RHSA-2012:0547, did not properly filter all php-cgi command line arguments. A specially crafted request to a PHP script could cause the PHP interpreter to execute the script in a loop, or output usage information that triggers an Internal Server Error. (CVE-2012-2336) A memory leak flaw was found in the PHP strtotime() function call. A remote attacker could possibly use this flaw to cause excessive memory consumption by triggering many strtotime() function calls. (CVE-2012-0789) It was found that PHP did not check the zend_strndup() function's return value in certain cases. A remote attacker could possibly use this flaw to crash a PHP application. (CVE-2011-4153) Upstream acknowledges Rubin Xu and Joseph Bonneau as the original reporters of CVE-2012-2143. All php53 users should upgrade to these updated packages, which contain backported patches to resolve these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect." ); script_set_attribute( attribute:"see_also", value:"https://rhn.redhat.com/errata/RHSA-2012-0547.html" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/errata/RHSA-2012:1047" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2012-2143" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2012-2336" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2012-0057" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2012-0789" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2011-4153" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2012-1172" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2012-2386" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2010-2950" ); script_set_attribute( attribute:"see_also", value:"https://www.tenable.com/security/research/tra-2012-01" ); script_set_attribute(attribute:"solution", value:"Update the affected packages."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"exploited_by_malware", value:"true"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-bcmath"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-cli"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-common"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-dba"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-gd"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-imap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-intl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-ldap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-mbstring"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-mysql"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-odbc"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-pdo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-pgsql"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-process"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-pspell"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-snmp"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-soap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-xml"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-xmlrpc"); script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:5"); script_set_attribute(attribute:"patch_publication_date", value:"2012/06/27"); script_set_attribute(attribute:"plugin_publication_date", value:"2012/06/28"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Red Hat Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("misc_func.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/RedHat/release"); if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat"); os_ver = eregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat"); os_ver = os_ver[1]; if (! ereg(pattern:"^5([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 5.x", "Red Hat " + os_ver); if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu); yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo"); if (!empty_or_null(yum_updateinfo)) { rhsa = "RHSA-2012:1047"; yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa); if (!empty_or_null(yum_report)) { security_report_v4( port : 0, severity : SECURITY_HOLE, extra : yum_report ); exit(0); } else { audit_message = "affected by Red Hat security advisory " + rhsa; audit(AUDIT_OS_NOT, audit_message); } } else { flag = 0; if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-bcmath-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-bcmath-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-bcmath-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-cli-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-cli-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-cli-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-common-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-common-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-common-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-dba-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-dba-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-dba-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-debuginfo-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-debuginfo-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-debuginfo-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-devel-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-devel-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-devel-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-gd-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-gd-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-gd-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-imap-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-imap-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-imap-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-intl-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-intl-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-intl-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-ldap-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-ldap-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-ldap-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-mbstring-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-mbstring-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-mbstring-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-mysql-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-mysql-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-mysql-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-odbc-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-odbc-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-odbc-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-pdo-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-pdo-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-pdo-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-pgsql-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-pgsql-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-pgsql-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-process-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-process-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-process-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-pspell-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-pspell-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-pspell-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-snmp-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-snmp-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-snmp-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-soap-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-soap-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-soap-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-xml-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-xml-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-xml-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-xmlrpc-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-xmlrpc-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-xmlrpc-5.3.3-13.el5_8")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_HOLE, extra : rpm_report_get() + redhat_report_package_caveat() ); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "php53 / php53-bcmath / php53-cli / php53-common / php53-dba / etc"); } }NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-201110-06.NASL description The remote host is affected by the vulnerability described in GLSA-201110-06 (PHP: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in PHP. Please review the CVE identifiers referenced below for details. Impact : A context-dependent attacker could execute arbitrary code, obtain sensitive information from process memory, bypass intended access restrictions, or cause a Denial of Service in various ways. A remote attacker could cause a Denial of Service in various ways, bypass spam detections, or bypass open_basedir restrictions. Workaround : There is no known workaround at this time. last seen 2020-06-01 modified 2020-06-02 plugin id 56459 published 2011-10-12 reporter This script is Copyright (C) 2011-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/56459 title GLSA-201110-06 : PHP: Multiple vulnerabilities code # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Gentoo Linux Security Advisory GLSA 201110-06. # # The advisory text is Copyright (C) 2001-2016 Gentoo Foundation, Inc. # and licensed under the Creative Commons - Attribution / Share Alike # license. See http://creativecommons.org/licenses/by-sa/3.0/ # include("compat.inc"); if (description) { script_id(56459); script_version("1.9"); script_cvs_date("Date: 2018/07/11 17:09:26"); script_cve_id("CVE-2006-7243", "CVE-2009-5016", "CVE-2010-1128", "CVE-2010-1129", "CVE-2010-1130", "CVE-2010-1860", "CVE-2010-1861", "CVE-2010-1862", "CVE-2010-1864", "CVE-2010-1866", "CVE-2010-1868", "CVE-2010-1914", "CVE-2010-1915", "CVE-2010-1917", "CVE-2010-2093", "CVE-2010-2094", "CVE-2010-2097", "CVE-2010-2100", "CVE-2010-2101", "CVE-2010-2190", "CVE-2010-2191", "CVE-2010-2225", "CVE-2010-2484", "CVE-2010-2531", "CVE-2010-2950", "CVE-2010-3062", "CVE-2010-3063", "CVE-2010-3064", "CVE-2010-3065", "CVE-2010-3436", "CVE-2010-3709", "CVE-2010-3710", "CVE-2010-3870", "CVE-2010-4150", "CVE-2010-4409", "CVE-2010-4645", "CVE-2010-4697", "CVE-2010-4698", "CVE-2010-4699", "CVE-2010-4700", "CVE-2011-0420", "CVE-2011-0421", "CVE-2011-0708", "CVE-2011-0752", "CVE-2011-0753", "CVE-2011-0755", "CVE-2011-1092", "CVE-2011-1148", "CVE-2011-1153", "CVE-2011-1464", "CVE-2011-1466", "CVE-2011-1467", "CVE-2011-1468", "CVE-2011-1469", "CVE-2011-1470", "CVE-2011-1471", "CVE-2011-1657", "CVE-2011-1938", "CVE-2011-2202", "CVE-2011-2483", "CVE-2011-3182", "CVE-2011-3189", "CVE-2011-3267", "CVE-2011-3268"); script_xref(name:"GLSA", value:"201110-06"); script_name(english:"GLSA-201110-06 : PHP: Multiple vulnerabilities"); script_summary(english:"Checks for updated package(s) in /var/db/pkg"); script_set_attribute( attribute:"synopsis", value: "The remote Gentoo host is missing one or more security-related patches." ); script_set_attribute( attribute:"description", value: "The remote host is affected by the vulnerability described in GLSA-201110-06 (PHP: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in PHP. Please review the CVE identifiers referenced below for details. Impact : A context-dependent attacker could execute arbitrary code, obtain sensitive information from process memory, bypass intended access restrictions, or cause a Denial of Service in various ways. A remote attacker could cause a Denial of Service in various ways, bypass spam detections, or bypass open_basedir restrictions. Workaround : There is no known workaround at this time." ); script_set_attribute( attribute:"see_also", value:"https://security.gentoo.org/glsa/201110-06" ); script_set_attribute( attribute:"solution", value: "All PHP users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose '>=dev-lang/php-5.3.8'" ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:php"); script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux"); script_set_attribute(attribute:"patch_publication_date", value:"2011/10/10"); script_set_attribute(attribute:"plugin_publication_date", value:"2011/10/12"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2011-2018 Tenable Network Security, Inc."); script_family(english:"Gentoo Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("qpkg.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo"); if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING); flag = 0; if (qpkg_check(package:"dev-lang/php", unaffected:make_list("ge 5.3.8"), vulnerable:make_list("lt 5.3.8"))) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get()); else security_hole(0); exit(0); } else { tested = qpkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "PHP"); }NASL family Scientific Linux Local Security Checks NASL id SL_20120627_PHP53_ON_SL5_X.NASL description PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was discovered that the PHP XSL extension did not restrict the file writing capability of libxslt. A remote attacker could use this flaw to create or overwrite an arbitrary file that is writable by the user running PHP, if a PHP script processed untrusted eXtensible Style Sheet Language Transformations (XSLT) content. (CVE-2012-0057) Note: This update disables file writing by default. A new PHP configuration directive, last seen 2020-03-18 modified 2012-08-01 plugin id 61356 published 2012-08-01 reporter This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/61356 title Scientific Linux Security Update : php53 on SL5.x i386/x86_64 (20120627) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text is (C) Scientific Linux. # include("compat.inc"); if (description) { script_id(61356); script_version("1.12"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/12"); script_cve_id("CVE-2010-2950", "CVE-2011-4153", "CVE-2012-0057", "CVE-2012-0789", "CVE-2012-1172", "CVE-2012-2143", "CVE-2012-2336", "CVE-2012-2386"); script_xref(name:"TRA", value:"TRA-2012-01"); script_name(english:"Scientific Linux Security Update : php53 on SL5.x i386/x86_64 (20120627)"); script_summary(english:"Checks rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value: "The remote Scientific Linux host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was discovered that the PHP XSL extension did not restrict the file writing capability of libxslt. A remote attacker could use this flaw to create or overwrite an arbitrary file that is writable by the user running PHP, if a PHP script processed untrusted eXtensible Style Sheet Language Transformations (XSLT) content. (CVE-2012-0057) Note: This update disables file writing by default. A new PHP configuration directive, 'xsl.security_prefs', can be used to enable file writing in XSLT. A flaw was found in the way PHP validated file names in file upload requests. A remote attacker could possibly use this flaw to bypass the sanitization of the uploaded file names, and cause a PHP script to store the uploaded file in an unexpected directory, by using a directory traversal attack. (CVE-2012-1172) Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in the way the PHP phar extension processed certain fields of tar archive files. A remote attacker could provide a specially crafted tar archive file that, when processed by a PHP application using the phar extension, could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running PHP. (CVE-2012-2386) A format string flaw was found in the way the PHP phar extension processed certain PHAR files. A remote attacker could provide a specially crafted PHAR file, which once processed in a PHP application using the phar extension, could lead to information disclosure and possibly arbitrary code execution via a crafted phar:// URI. (CVE-2010-2950) A flaw was found in the DES algorithm implementation in the crypt() password hashing function in PHP. If the password string to be hashed contained certain characters, the remainder of the string was ignored when calculating the hash, significantly reducing the password strength. (CVE-2012-2143) Note: With this update, passwords are no longer truncated when performing DES hashing. Therefore, new hashes of the affected passwords will not match stored hashes generated using vulnerable PHP versions, and will need to be updated. It was discovered that the fix for CVE-2012-1823, released via a previous update, did not properly filter all php-cgi command line arguments. A specially crafted request to a PHP script could cause the PHP interpreter to execute the script in a loop, or output usage information that triggers an Internal Server Error. (CVE-2012-2336) A memory leak flaw was found in the PHP strtotime() function call. A remote attacker could possibly use this flaw to cause excessive memory consumption by triggering many strtotime() function calls. (CVE-2012-0789) It was found that PHP did not check the zend_strndup() function's return value in certain cases. A remote attacker could possibly use this flaw to crash a PHP application. (CVE-2011-4153) All php53 users should upgrade to these updated packages, which contain backported patches to resolve these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect." ); # https://listserv.fnal.gov/scripts/wa.exe?A2=ind1207&L=scientific-linux-errata&T=0&P=594 script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?84d5fe48" ); script_set_attribute( attribute:"see_also", value:"https://www.tenable.com/security/research/tra-2012-01" ); script_set_attribute(attribute:"solution", value:"Update the affected packages."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"exploited_by_malware", value:"true"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-bcmath"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-cli"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-common"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-dba"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-gd"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-imap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-intl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-ldap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-mbstring"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-mysql"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-odbc"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-pdo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-pgsql"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-process"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-pspell"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-snmp"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-soap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-xml"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-xmlrpc"); script_set_attribute(attribute:"cpe", value:"x-cpe:/o:fermilab:scientific_linux"); script_set_attribute(attribute:"vuln_publication_date", value:"2010/09/28"); script_set_attribute(attribute:"patch_publication_date", value:"2012/06/27"); script_set_attribute(attribute:"plugin_publication_date", value:"2012/08/01"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Scientific Linux Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/RedHat/release", "Host/RedHat/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("misc_func.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/RedHat/release"); if (isnull(release) || "Scientific Linux " >!< release) audit(AUDIT_HOST_NOT, "running Scientific Linux"); os_ver = pregmatch(pattern: "Scientific Linux.*release ([0-9]+(\.[0-9]+)?)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Scientific Linux"); os_ver = os_ver[1]; if (! preg(pattern:"^5([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Scientific Linux 5.x", "Scientific Linux " + os_ver); if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if (cpu >!< "x86_64" && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Scientific Linux", cpu); flag = 0; if (rpm_check(release:"SL5", reference:"php53-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"SL5", reference:"php53-bcmath-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"SL5", reference:"php53-cli-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"SL5", reference:"php53-common-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"SL5", reference:"php53-dba-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"SL5", reference:"php53-debuginfo-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"SL5", reference:"php53-devel-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"SL5", reference:"php53-gd-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"SL5", reference:"php53-imap-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"SL5", reference:"php53-intl-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"SL5", reference:"php53-ldap-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"SL5", reference:"php53-mbstring-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"SL5", reference:"php53-mysql-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"SL5", reference:"php53-odbc-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"SL5", reference:"php53-pdo-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"SL5", reference:"php53-pgsql-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"SL5", reference:"php53-process-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"SL5", reference:"php53-pspell-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"SL5", reference:"php53-snmp-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"SL5", reference:"php53-soap-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"SL5", reference:"php53-xml-5.3.3-13.el5_8")) flag++; if (rpm_check(release:"SL5", reference:"php53-xmlrpc-5.3.3-13.el5_8")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_HOLE, extra : rpm_report_get() ); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "php53 / php53-bcmath / php53-cli / php53-common / php53-dba / etc"); }NASL family Fedora Local Security Checks NASL id FEDORA_2010-18976.NASL description Security Enhancements and Fixes in PHP 5.3.4 : - Fixed crash in zip extract method (possible CWE-170). - Paths with NULL in them (foo\0bar.txt) are now considered as invalid (CVE-2006-7243). - Fixed a possible double free in imap extension (Identified by Mateusz Kocielski). (CVE-2010-4150). - Fixed NULL pointer dereference in ZipArchive::getArchiveComment. (CVE-2010-3709). - Fixed possible flaw in open_basedir (CVE-2010-3436). - Fixed MOPS-2010-24, fix string validation. (CVE-2010-2950). - Fixed symbolic resolution support when the target is a DFS share. - Fixed bug #52929 (Segfault in filter_var with FILTER_VALIDATE_EMAIL with large amount of data) (CVE-2010-3710). Key Bug Fixes in PHP 5.3.4 include : - Added stat support for zip stream. - Added follow_location (enabled by default) option for the http stream support. - Added a 3rd parameter to get_html_translation_table. It now takes a charset hint, like htmlentities et al. - Implemented FR #52348, added new constant ZEND_MULTIBYTE to detect zend multibyte at runtime. Full upstream Changelog : http://www.php.net/ChangeLog-5.php#5.3.4 This update also provides php-eaccelerator and maniadrive packages rebuild against update php. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 51412 published 2011-01-05 reporter This script is Copyright (C) 2011-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/51412 title Fedora 14 : maniadrive-1.2-23.fc14 / php-5.3.4-1.fc14.1 / php-eaccelerator-0.9.6.1-3.fc14 (2010-18976) NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_B2A6FC0E070F11E0A6E900215C6A37BB.NASL description The following package needs to be updated: php52 last seen 2016-09-26 modified 2011-10-03 plugin id 51152 published 2010-12-14 reporter Tenable source https://www.tenable.com/plugins/index.php?view=single&id=51152 title FreeBSD : php -- multiple vulnerabilities (5353) NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2012-1046.NASL description From Red Hat Security Advisory 2012:1046 : Updated php packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was discovered that the PHP XSL extension did not restrict the file writing capability of libxslt. A remote attacker could use this flaw to create or overwrite an arbitrary file that is writable by the user running PHP, if a PHP script processed untrusted eXtensible Style Sheet Language Transformations (XSLT) content. (CVE-2012-0057) Note: This update disables file writing by default. A new PHP configuration directive, last seen 2020-06-01 modified 2020-06-02 plugin id 68570 published 2013-07-12 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/68570 title Oracle Linux 6 : php (ELSA-2012-1046) NASL family CentOS Local Security Checks NASL id CENTOS_RHSA-2012-1047.NASL description Updated php53 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was discovered that the PHP XSL extension did not restrict the file writing capability of libxslt. A remote attacker could use this flaw to create or overwrite an arbitrary file that is writable by the user running PHP, if a PHP script processed untrusted eXtensible Style Sheet Language Transformations (XSLT) content. (CVE-2012-0057) Note: This update disables file writing by default. A new PHP configuration directive, last seen 2020-06-01 modified 2020-06-02 plugin id 67089 published 2013-06-29 reporter This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/67089 title CentOS 5 : php53 (CESA-2012:1047) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2012-1046.NASL description Updated php packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was discovered that the PHP XSL extension did not restrict the file writing capability of libxslt. A remote attacker could use this flaw to create or overwrite an arbitrary file that is writable by the user running PHP, if a PHP script processed untrusted eXtensible Style Sheet Language Transformations (XSLT) content. (CVE-2012-0057) Note: This update disables file writing by default. A new PHP configuration directive, last seen 2020-06-01 modified 2020-06-02 plugin id 59752 published 2012-06-28 reporter This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/59752 title RHEL 6 : php (RHSA-2012:1046) NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2012-1047.NASL description From Red Hat Security Advisory 2012:1047 : Updated php53 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was discovered that the PHP XSL extension did not restrict the file writing capability of libxslt. A remote attacker could use this flaw to create or overwrite an arbitrary file that is writable by the user running PHP, if a PHP script processed untrusted eXtensible Style Sheet Language Transformations (XSLT) content. (CVE-2012-0057) Note: This update disables file writing by default. A new PHP configuration directive, last seen 2020-06-01 modified 2020-06-02 plugin id 68571 published 2013-07-12 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/68571 title Oracle Linux 5 : php53 (ELSA-2012-1047) NASL family Mandriva Local Security Checks NASL id MANDRIVA_MDVSA-2010-254.NASL description This is a maintenance and security update that upgrades php to 5.3.4 for 2010.0/2010.1. Security Enhancements and Fixes in PHP 5.3.4 : - Paths with NULL in them (foo\0bar.txt) are now considered as invalid (CVE-2006-7243). - Fixed bug #53512 (NumberFormatter::setSymbol crash on bogus values) (CVE-2010-4409) Please note that CVE-2010-4150, CVE-2010-3870, CVE-2010-3436, CVE-2010-3709, CVE-2010-3710 were fixed in previous advisories. Key Bug Fixes in PHP 5.3.4 include : - Added stat support for zip stream. - Added follow_location (enabled by default) option for the http stream support. - Added a 3rd parameter to get_html_translation_table. It now takes a charset hint, like htmlentities et al. - Implemented FR #52348, added new constant ZEND_MULTIBYTE to detect zend multibyte at runtime. - Multiple improvements to the FPM SAPI. - Over 100 other bug fixes. Additional post 5.3.4 fixes : - Fixed bug #53517 (segfault in pgsql_stmt_execute() when postgres is down). - Fixed bug #53541 (format string bug in ext/phar). Additionally some of the PECL extensions has been upgraded and/or rebuilt for the new php version. last seen 2020-06-01 modified 2020-06-02 plugin id 51196 published 2010-12-16 reporter This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/51196 title Mandriva Linux Security Advisory : php (MDVSA-2010:254) NASL family Fedora Local Security Checks NASL id FEDORA_2010-19011.NASL description Security Enhancements and Fixes in PHP 5.3.4 : - Fixed crash in zip extract method (possible CWE-170). - Paths with NULL in them (foo\0bar.txt) are now considered as invalid (CVE-2006-7243). - Fixed a possible double free in imap extension (Identified by Mateusz Kocielski). (CVE-2010-4150). - Fixed NULL pointer dereference in ZipArchive::getArchiveComment. (CVE-2010-3709). - Fixed possible flaw in open_basedir (CVE-2010-3436). - Fixed MOPS-2010-24, fix string validation. (CVE-2010-2950). - Fixed symbolic resolution support when the target is a DFS share. - Fixed bug #52929 (Segfault in filter_var with FILTER_VALIDATE_EMAIL with large amount of data) (CVE-2010-3710). Key Bug Fixes in PHP 5.3.4 include : - Added stat support for zip stream. - Added follow_location (enabled by default) option for the http stream support. - Added a 3rd parameter to get_html_translation_table. It now takes a charset hint, like htmlentities et al. - Implemented FR #52348, added new constant ZEND_MULTIBYTE to detect zend multibyte at runtime. Full upstream Changelog : http://www.php.net/ChangeLog-5.php#5.3.4 This update also provides php-eaccelerator and maniadrive packages rebuild against update php. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 51413 published 2011-01-05 reporter This script is Copyright (C) 2011-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/51413 title Fedora 13 : maniadrive-1.2-23.fc13 / php-5.3.4-1.fc13.1 / php-eaccelerator-0.9.6.1-3.fc13 (2010-19011) NASL family MacOS X Local Security Checks NASL id MACOSX_10_6_7.NASL description The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.7. Mac OS X 10.6.7 contains security fixes for the following products : - AirPort - Apache - AppleScript - ATS - bzip2 - CarbonCore - ClamAV - CoreText - File Quarantine - HFS - ImageIO - Image RAW - Installer - Kerberos - Kernel - Libinfo - libxml - Mailman - PHP - QuickLook - QuickTime - Ruby - Samba - Subversion - Terminal - X11 last seen 2020-06-01 modified 2020-06-02 plugin id 52754 published 2011-03-22 reporter This script is Copyright (C) 2011-2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/52754 title Mac OS X 10.6.x < 10.6.7 Multiple Vulnerabilities NASL family SuSE Local Security Checks NASL id SUSE_11_2_APACHE2-MOD_PHP5-100813.NASL description PHP was updated to version 5.3.3 to fix serveral security issues. (CVE-2010-0397, CVE-2010-1860, CVE-2010-1862, CVE-2010-1864, CVE-2010-1866, CVE-2010-1914, CVE-2010-1915, CVE-2010-1917, CVE-2010-2093, CVE-2010-2094, CVE-2010-2097, CVE-2010-2100, CVE-2010-2101, CVE-2010-2190, CVE-2010-2191, CVE-2010-2225, CVE-2010-2531, CVE-2010-2950, CVE-2010-3062, CVE-2010-3063, CVE-2010-3064, CVE-2010-3065) last seen 2020-06-01 modified 2020-06-02 plugin id 49210 published 2010-09-13 reporter This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/49210 title openSUSE Security Update : apache2-mod_php5 (openSUSE-SU-2010:0599-1) NASL family CentOS Local Security Checks NASL id CENTOS_RHSA-2012-1046.NASL description Updated php packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was discovered that the PHP XSL extension did not restrict the file writing capability of libxslt. A remote attacker could use this flaw to create or overwrite an arbitrary file that is writable by the user running PHP, if a PHP script processed untrusted eXtensible Style Sheet Language Transformations (XSLT) content. (CVE-2012-0057) Note: This update disables file writing by default. A new PHP configuration directive, last seen 2020-06-01 modified 2020-06-02 plugin id 59938 published 2012-07-11 reporter This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/59938 title CentOS 6 : php (CESA-2012:1046) NASL family Web Servers NASL id HPSMH_6_3_0_22.NASL description According to the web server last seen 2020-06-01 modified 2020-06-02 plugin id 53532 published 2011-04-22 reporter This script is Copyright (C) 2011-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/53532 title HP System Management Homepage < 6.3 Multiple Vulnerabilities NASL family CGI abuses NASL id PHP_5_3_4.NASL description According to its banner, the version of PHP 5.3 installed on the remote host is older than 5.3.4. Such versions may be affected by several security issues : - A crash in the zip extract method. - A stack-based buffer overflow in impagepstext() of the GD extension. - An unspecified vulnerability related to symbolic resolution when using a DFS share. - A security bypass vulnerability related to using pathnames containing NULL bytes. (CVE-2006-7243) - Multiple format string vulnerabilities. (CVE-2010-2094, CVE-2010-2950) - An unspecified security bypass vulnerability in open_basedir(). (CVE-2010-3436) - A NULL pointer dereference in ZipArchive::getArchiveComment. (CVE-2010-3709) - Memory corruption in php_filter_validate_email(). (CVE-2010-3710) - An input validation vulnerability in xml_utf8_decode(). (CVE-2010-3870) - A possible double free in the IMAP extension. (CVE-2010-4150) - An information disclosure vulnerability in last seen 2020-06-01 modified 2020-06-02 plugin id 51140 published 2010-12-13 reporter This script is Copyright (C) 2010-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/51140 title PHP 5.3 < 5.3.4 Multiple Vulnerabilities NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-989-1.NASL description Auke van Slooten discovered that PHP incorrectly handled certain xmlrpc requests. An attacker could exploit this issue to cause the PHP server to crash, resulting in a denial of service. This issue only affected Ubuntu 6.06 LTS, 8.04 LTS, 9.04 and 9.10. (CVE-2010-0397) It was discovered that the pseudorandom number generator in PHP did not provide the expected entropy. An attacker could exploit this issue to predict values that were intended to be random, such as session cookies. This issue only affected Ubuntu 6.06 LTS, 8.04 LTS, 9.04 and 9.10. (CVE-2010-1128) It was discovered that PHP did not properly handle directory pathnames that lacked a trailing slash character. An attacker could exploit this issue to bypass safe_mode restrictions. This issue only affected Ubuntu 6.06 LTS, 8.04 LTS, 9.04 and 9.10. (CVE-2010-1129) Grzegorz Stachowiak discovered that the PHP session extension did not properly handle semicolon characters. An attacker could exploit this issue to bypass safe_mode restrictions. This issue only affected Ubuntu 8.04 LTS, 9.04 and 9.10. (CVE-2010-1130) Stefan Esser discovered that PHP incorrectly decoded remote HTTP chunked encoding streams. An attacker could exploit this issue to cause the PHP server to crash and possibly execute arbitrary code with application privileges. This issue only affected Ubuntu 10.04 LTS. (CVE-2010-1866) Mateusz Kocielski discovered that certain PHP SQLite functions incorrectly handled empty SQL queries. An attacker could exploit this issue to possibly execute arbitrary code with application privileges. (CVE-2010-1868) Mateusz Kocielski discovered that PHP incorrectly handled certain arguments to the fnmatch function. An attacker could exploit this flaw and cause the PHP server to consume all available stack memory, resulting in a denial of service. (CVE-2010-1917) Stefan Esser discovered that PHP incorrectly handled certain strings in the phar extension. An attacker could exploit this flaw to possibly view sensitive information. This issue only affected Ubuntu 10.04 LTS. (CVE-2010-2094, CVE-2010-2950) Stefan Esser discovered that PHP incorrectly handled deserialization of SPLObjectStorage objects. A remote attacker could exploit this issue to view sensitive information and possibly execute arbitrary code with application privileges. This issue only affected Ubuntu 8.04 LTS, 9.04, 9.10 and 10.04 LTS. (CVE-2010-2225) It was discovered that PHP incorrectly filtered error messages when limits for memory, execution time, or recursion were exceeded. A remote attacker could exploit this issue to possibly view sensitive information. (CVE-2010-2531) Stefan Esser discovered that the PHP session serializer incorrectly handled the PS_UNDEF_MARKER marker. An attacker could exploit this issue to alter arbitrary session variables. (CVE-2010-3065). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 49306 published 2010-09-21 reporter Ubuntu Security Notice (C) 2010-2019 Canonical, Inc. / NASL script (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/49306 title Ubuntu 6.06 LTS / 8.04 LTS / 9.04 / 9.10 / 10.04 LTS : php5 vulnerabilities (USN-989-1)
Redhat
| rpms |
|
References
- http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html
- http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html
- http://marc.info/?l=bugtraq&m=130331363227777&w=2
- http://php-security.org/2010/05/14/mops-2010-024-php-phar_stream_flush-format-string-vulnerability/index.html
- http://security-tracker.debian.org/tracker/CVE-2010-2950
- http://support.apple.com/kb/HT4581
- http://svn.php.net/viewvc?view=revision&revision=302565
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:254
- http://www.php.net/archive/2010.php#id2010-12-10-1
- http://www.php.net/ChangeLog-5.php
- http://www.php.net/releases/5_3_4.php
- https://bugzilla.redhat.com/show_bug.cgi?id=598537