Vulnerabilities > CVE-2011-4566 - Numeric Errors vulnerability in multiple products
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
PARTIAL Integrity impact
NONE Availability impact
PARTIAL Summary
Integer overflow in the exif_process_IFD_TAG function in exif.c in the exif extension in PHP 5.4.0beta2 on 32-bit platforms allows remote attackers to read the contents of arbitrary memory locations or cause a denial of service via a crafted offset_val value in an EXIF header in a JPEG file, a different vulnerability than CVE-2011-0708.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 43 | |
| OS | 3 | |
| OS | 5 |
Common Weakness Enumeration (CWE)
Nessus
NASL family MacOS X Local Security Checks NASL id MACOSX_10_7_4.NASL description The remote host is running a version of Mac OS X 10.7.x that is prior to 10.7.4. The newer version contains numerous security-related fixes for the following components : - Login Window - Bluetooth - curl - HFS - Kernel - libarchive - libsecurity - libxml - LoginUIFramework - PHP - Quartz Composer - QuickTime - Ruby - Security Framework - Time Machine - X11 Note that this update addresses the recent FileVault password vulnerability, in which user passwords are stored in plaintext to a system-wide debug log if the legacy version of FileVault is used to encrypt user directories after a system upgrade to Lion. Since the patch only limits further exposure, though, we recommend that all users on the system change their passwords if user folders were encrypted using the legacy version of FileVault prior to and after an upgrade to OS X 10.7. last seen 2020-06-01 modified 2020-06-02 plugin id 59066 published 2012-05-10 reporter This script is Copyright (C) 2012-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/59066 title Mac OS X 10.7.x < 10.7.4 Multiple Vulnerabilities (BEAST) code # # (C) Tenable Network Security, Inc. # if (!defined_func("bn_random")) exit(0); if (NASL_LEVEL < 3000) exit(0); # Avoid problems with large number of xrefs. include("compat.inc"); if (description) { script_id(59066); script_version("1.27"); script_cvs_date("Date: 2018/07/16 12:48:31"); script_cve_id( "CVE-2011-1004", "CVE-2011-1005", "CVE-2011-1777", "CVE-2011-1778", "CVE-2011-1944", "CVE-2011-2821", "CVE-2011-2834", "CVE-2011-2895", "CVE-2011-3212", "CVE-2011-3389", "CVE-2011-3919", "CVE-2011-4566", "CVE-2011-4815", "CVE-2011-4885", "CVE-2012-0036", "CVE-2012-0642", "CVE-2012-0649", "CVE-2012-0652", "CVE-2012-0654", "CVE-2012-0655", "CVE-2012-0656", "CVE-2012-0657", "CVE-2012-0658", "CVE-2012-0659", "CVE-2012-0660", "CVE-2012-0661", "CVE-2012-0662", "CVE-2012-0675", "CVE-2012-0830" ); script_bugtraq_id( 46458, 46460, 47737, 48056, 49124, 49279, 49658, 49778, 50907, 51193, 51198, 51300, 51665, 51830, 52364, 53456, 53457, 53459, 53462, 53465, 53466, 53467, 53468, 53469, 53470, 53471, 53473 ); script_xref(name:"TRA", value:"TRA-2012-02"); script_xref(name:"CERT", value:"864643"); script_xref(name:"ZDI", value:"ZDI-12-135"); script_name(english:"Mac OS X 10.7.x < 10.7.4 Multiple Vulnerabilities (BEAST)"); script_summary(english:"Check the version of Mac OS X."); script_set_attribute( attribute:"synopsis", value: "The remote host is missing a Mac OS X update that fixes several security issues." ); script_set_attribute( attribute:"description", value: "The remote host is running a version of Mac OS X 10.7.x that is prior to 10.7.4. The newer version contains numerous security-related fixes for the following components : - Login Window - Bluetooth - curl - HFS - Kernel - libarchive - libsecurity - libxml - LoginUIFramework - PHP - Quartz Composer - QuickTime - Ruby - Security Framework - Time Machine - X11 Note that this update addresses the recent FileVault password vulnerability, in which user passwords are stored in plaintext to a system-wide debug log if the legacy version of FileVault is used to encrypt user directories after a system upgrade to Lion. Since the patch only limits further exposure, though, we recommend that all users on the system change their passwords if user folders were encrypted using the legacy version of FileVault prior to and after an upgrade to OS X 10.7." ); script_set_attribute(attribute:"see_also", value:"https://www.tenable.com/security/research/tra-2012-02"); script_set_attribute(attribute:"see_also", value:"http://support.apple.com/kb/HT5281"); script_set_attribute(attribute:"see_also", value:"http://lists.apple.com/archives/security-announce/2012/May/msg00001.html"); script_set_attribute(attribute:"see_also", value:"http://www.zerodayinitiative.com/advisories/ZDI-12-135"); script_set_attribute(attribute:"see_also", value:"http://seclists.org/fulldisclosure/2012/Aug/64"); script_set_attribute(attribute:"see_also", value:"https://www.imperialviolet.org/2011/09/23/chromeandbeast.html"); script_set_attribute(attribute:"see_also", value:"https://www.openssl.org/~bodo/tls-cbc.txt"); script_set_attribute( attribute:"solution", value:"Upgrade to Mac OS X 10.7.4 or later." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"exploit_framework_core", value:"true"); script_set_attribute(attribute:"exploited_by_malware", value:"true"); script_set_attribute(attribute:"vuln_publication_date", value:"2011/02/18"); script_set_attribute(attribute:"patch_publication_date", value:"2012/05/09"); script_set_attribute(attribute:"plugin_publication_date", value:"2012/05/10"); script_set_attribute(attribute:"plugin_type", value:"combined"); script_set_attribute(attribute:"cpe", value:"cpe:/o:apple:mac_os_x"); script_set_attribute(attribute:"in_the_news", value:"true"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"MacOS X Local Security Checks"); script_copyright(english:"This script is Copyright (C) 2012-2018 Tenable Network Security, Inc."); script_dependencies("ssh_get_info.nasl", "os_fingerprint.nasl"); exit(0); } os = get_kb_item("Host/MacOSX/Version"); if (!os) { os = get_kb_item("Host/OS"); if (isnull(os)) exit(0, "The 'Host/OS' KB item is missing."); if ("Mac OS X" >!< os) exit(0, "The host does not appear to be running Mac OS X."); c = get_kb_item("Host/OS/Confidence"); if (c <= 70) exit(1, "Can't determine the host's OS with sufficient confidence."); } if (!os) exit(0, "The host does not appear to be running Mac OS X."); if (ereg(pattern:"Mac OS X 10\.7($|\.[0-3]([^0-9]|$))", string:os)) security_hole(0); else exit(0, "The host is not affected as it is running "+os+".");NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2012-0019.NASL description Updated php53 and php packages that fix two security issues are now available for Red Hat Enterprise Linux 5 and 6 respectively. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was found that the hashing routine used by PHP arrays was susceptible to predictable hash collisions. If an HTTP POST request to a PHP application contained many parameters whose names map to the same hash value, a large amount of CPU time would be consumed. This flaw has been mitigated by adding a new configuration directive, max_input_vars, that limits the maximum number of parameters processed per request. By default, max_input_vars is set to 1000. (CVE-2011-4885) An integer overflow flaw was found in the PHP exif extension. On 32-bit systems, a specially crafted image file could cause the PHP interpreter to crash or disclose portions of its memory when a PHP script tries to extract Exchangeable image file format (Exif) metadata from the image file. (CVE-2011-4566) Red Hat would like to thank oCERT for reporting CVE-2011-4885. oCERT acknowledges Julian Walde and Alexander Klink as the original reporters of CVE-2011-4885. All php53 and php users should upgrade to these updated packages, which contain backported patches to resolve these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect. last seen 2020-04-16 modified 2012-01-12 plugin id 57494 published 2012-01-12 reporter This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/57494 title RHEL 5 / 6 : php53 and php (RHSA-2012:0019) code # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Red Hat Security Advisory RHSA-2012:0019. The text # itself is copyright (C) Red Hat, Inc. # include("compat.inc"); if (description) { script_id(57494); script_version ("1.27"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/04/15"); script_cve_id("CVE-2011-4566", "CVE-2011-4885"); script_bugtraq_id(50907, 51193); script_xref(name:"RHSA", value:"2012:0019"); script_name(english:"RHEL 5 / 6 : php53 and php (RHSA-2012:0019)"); script_summary(english:"Checks the rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value:"The remote Red Hat host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "Updated php53 and php packages that fix two security issues are now available for Red Hat Enterprise Linux 5 and 6 respectively. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was found that the hashing routine used by PHP arrays was susceptible to predictable hash collisions. If an HTTP POST request to a PHP application contained many parameters whose names map to the same hash value, a large amount of CPU time would be consumed. This flaw has been mitigated by adding a new configuration directive, max_input_vars, that limits the maximum number of parameters processed per request. By default, max_input_vars is set to 1000. (CVE-2011-4885) An integer overflow flaw was found in the PHP exif extension. On 32-bit systems, a specially crafted image file could cause the PHP interpreter to crash or disclose portions of its memory when a PHP script tries to extract Exchangeable image file format (Exif) metadata from the image file. (CVE-2011-4566) Red Hat would like to thank oCERT for reporting CVE-2011-4885. oCERT acknowledges Julian Walde and Alexander Klink as the original reporters of CVE-2011-4885. All php53 and php users should upgrade to these updated packages, which contain backported patches to resolve these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect." ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/errata/RHSA-2012:0019" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2011-4885" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2011-4566" ); script_set_attribute(attribute:"solution", value:"Update the affected packages."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P"); script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"exploit_framework_core", value:"true"); script_set_attribute(attribute:"exploited_by_malware", value:"true"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php-bcmath"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php-cli"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php-common"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php-dba"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php-embedded"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php-enchant"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php-gd"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php-imap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php-intl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php-ldap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php-mbstring"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php-mysql"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php-odbc"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php-pdo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php-pgsql"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php-process"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php-pspell"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php-recode"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php-snmp"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php-soap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php-tidy"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php-xml"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php-xmlrpc"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php-zts"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-bcmath"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-cli"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-common"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-dba"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-gd"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-imap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-intl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-ldap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-mbstring"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-mysql"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-odbc"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-pdo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-pgsql"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-process"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-pspell"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-snmp"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-soap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-xml"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-xmlrpc"); script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:5"); script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:6"); script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:6.2"); script_set_attribute(attribute:"vuln_publication_date", value:"2011/11/29"); script_set_attribute(attribute:"patch_publication_date", value:"2012/01/11"); script_set_attribute(attribute:"plugin_publication_date", value:"2012/01/12"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Red Hat Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("misc_func.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/RedHat/release"); if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat"); os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat"); os_ver = os_ver[1]; if (! preg(pattern:"^(5|6)([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 5.x / 6.x", "Red Hat " + os_ver); if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu); yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo"); if (!empty_or_null(yum_updateinfo)) { rhsa = "RHSA-2012:0019"; yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa); if (!empty_or_null(yum_report)) { security_report_v4( port : 0, severity : SECURITY_WARNING, extra : yum_report ); exit(0); } else { audit_message = "affected by Red Hat security advisory " + rhsa; audit(AUDIT_OS_NOT, audit_message); } } else { flag = 0; if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-bcmath-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-bcmath-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-bcmath-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-cli-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-cli-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-cli-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-common-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-common-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-common-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-dba-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-dba-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-dba-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-devel-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-devel-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-devel-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-gd-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-gd-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-gd-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-imap-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-imap-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-imap-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-intl-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-intl-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-intl-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-ldap-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-ldap-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-ldap-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-mbstring-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-mbstring-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-mbstring-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-mysql-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-mysql-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-mysql-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-odbc-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-odbc-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-odbc-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-pdo-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-pdo-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-pdo-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-pgsql-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-pgsql-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-pgsql-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-process-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-process-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-process-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-pspell-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-pspell-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-pspell-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-snmp-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-snmp-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-snmp-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-soap-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-soap-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-soap-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-xml-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-xml-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-xml-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-xmlrpc-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-xmlrpc-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-xmlrpc-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"i686", reference:"php-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"php-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"php-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"i686", reference:"php-bcmath-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"php-bcmath-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"php-bcmath-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"i686", reference:"php-cli-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"php-cli-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"php-cli-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"i686", reference:"php-common-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"php-common-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"php-common-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"i686", reference:"php-dba-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"php-dba-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"php-dba-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"i686", reference:"php-debuginfo-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"php-debuginfo-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"php-debuginfo-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"i686", reference:"php-devel-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"php-devel-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"php-devel-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"i686", reference:"php-embedded-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"php-embedded-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"php-embedded-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"i686", reference:"php-enchant-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"php-enchant-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"php-enchant-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"i686", reference:"php-gd-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"php-gd-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"php-gd-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"i686", reference:"php-imap-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"php-imap-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"php-imap-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"i686", reference:"php-intl-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"php-intl-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"php-intl-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"i686", reference:"php-ldap-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"php-ldap-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"php-ldap-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"i686", reference:"php-mbstring-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"php-mbstring-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"php-mbstring-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"i686", reference:"php-mysql-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"php-mysql-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"php-mysql-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"i686", reference:"php-odbc-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"php-odbc-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"php-odbc-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"i686", reference:"php-pdo-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"php-pdo-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"php-pdo-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"i686", reference:"php-pgsql-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"php-pgsql-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"php-pgsql-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"i686", reference:"php-process-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"php-process-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"php-process-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"i686", reference:"php-pspell-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"php-pspell-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"php-pspell-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"i686", reference:"php-recode-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"php-recode-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"php-recode-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"i686", reference:"php-snmp-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"php-snmp-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"php-snmp-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"i686", reference:"php-soap-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"php-soap-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"php-soap-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"i686", reference:"php-tidy-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"php-tidy-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"php-tidy-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"i686", reference:"php-xml-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"php-xml-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"php-xml-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"i686", reference:"php-xmlrpc-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"php-xmlrpc-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"php-xmlrpc-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"i686", reference:"php-zts-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"php-zts-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"php-zts-5.3.3-3.el6_2.5")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_WARNING, extra : rpm_report_get() + redhat_report_package_caveat() ); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "php / php-bcmath / php-cli / php-common / php-dba / php-debuginfo / etc"); } }NASL family Scientific Linux Local Security Checks NASL id SL_20120111_PHP53_AND_PHP_ON_SL5_X.NASL description PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was found that the hashing routine used by PHP arrays was susceptible to predictable hash collisions. If an HTTP POST request to a PHP application contained many parameters whose names map to the same hash value, a large amount of CPU time would be consumed. This flaw has been mitigated by adding a new configuration directive, max_input_vars, that limits the maximum number of parameters processed per request. By default, max_input_vars is set to 1000. (CVE-2011-4885) An integer overflow flaw was found in the PHP exif extension. On 32-bit systems, a specially crafted image file could cause the PHP interpreter to crash or disclose portions of its memory when a PHP script tries to extract Exchangeable image file format (Exif) metadata from the image file. (CVE-2011-4566) All php53 and php users should upgrade to these updated packages, which contain backported patches to resolve these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect. last seen 2020-03-18 modified 2012-08-01 plugin id 61219 published 2012-08-01 reporter This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/61219 title Scientific Linux Security Update : php53 and php on SL5.x, SL6.x i386/x86_64 (20120111) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text is (C) Scientific Linux. # include("compat.inc"); if (description) { script_id(61219); script_version("1.14"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/12"); script_cve_id("CVE-2011-4566", "CVE-2011-4885"); script_name(english:"Scientific Linux Security Update : php53 and php on SL5.x, SL6.x i386/x86_64 (20120111)"); script_summary(english:"Checks rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value: "The remote Scientific Linux host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was found that the hashing routine used by PHP arrays was susceptible to predictable hash collisions. If an HTTP POST request to a PHP application contained many parameters whose names map to the same hash value, a large amount of CPU time would be consumed. This flaw has been mitigated by adding a new configuration directive, max_input_vars, that limits the maximum number of parameters processed per request. By default, max_input_vars is set to 1000. (CVE-2011-4885) An integer overflow flaw was found in the PHP exif extension. On 32-bit systems, a specially crafted image file could cause the PHP interpreter to crash or disclose portions of its memory when a PHP script tries to extract Exchangeable image file format (Exif) metadata from the image file. (CVE-2011-4566) All php53 and php users should upgrade to these updated packages, which contain backported patches to resolve these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect." ); # https://listserv.fnal.gov/scripts/wa.exe?A2=ind1201&L=scientific-linux-errata&T=0&P=707 script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?62517f6e" ); script_set_attribute(attribute:"solution", value:"Update the affected packages."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"exploit_framework_core", value:"true"); script_set_attribute(attribute:"exploited_by_malware", value:"true"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-bcmath"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-cli"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-common"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-dba"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-embedded"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-enchant"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-gd"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-imap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-intl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-ldap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-mbstring"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-mysql"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-odbc"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-pdo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-pgsql"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-process"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-pspell"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-recode"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-snmp"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-soap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-tidy"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-xml"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-xmlrpc"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-zts"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-bcmath"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-cli"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-common"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-dba"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-gd"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-imap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-intl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-ldap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-mbstring"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-mysql"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-odbc"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-pdo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-pgsql"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-process"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-pspell"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-snmp"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-soap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-xml"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-xmlrpc"); script_set_attribute(attribute:"cpe", value:"x-cpe:/o:fermilab:scientific_linux"); script_set_attribute(attribute:"vuln_publication_date", value:"2011/11/29"); script_set_attribute(attribute:"patch_publication_date", value:"2012/01/11"); script_set_attribute(attribute:"plugin_publication_date", value:"2012/08/01"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Scientific Linux Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/RedHat/release", "Host/RedHat/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("misc_func.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/RedHat/release"); if (isnull(release) || "Scientific Linux " >!< release) audit(AUDIT_HOST_NOT, "running Scientific Linux"); os_ver = pregmatch(pattern: "Scientific Linux.*release ([0-9]+(\.[0-9]+)?)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Scientific Linux"); os_ver = os_ver[1]; if (! preg(pattern:"^6([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Scientific Linux 6.x", "Scientific Linux " + os_ver); if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if (cpu >!< "x86_64" && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Scientific Linux", cpu); flag = 0; if (rpm_check(release:"SL5", reference:"php53-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"SL5", reference:"php53-bcmath-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"SL5", reference:"php53-cli-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"SL5", reference:"php53-common-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"SL5", reference:"php53-dba-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"SL5", reference:"php53-debuginfo-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"SL5", reference:"php53-devel-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"SL5", reference:"php53-gd-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"SL5", reference:"php53-imap-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"SL5", reference:"php53-intl-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"SL5", reference:"php53-ldap-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"SL5", reference:"php53-mbstring-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"SL5", reference:"php53-mysql-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"SL5", reference:"php53-odbc-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"SL5", reference:"php53-pdo-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"SL5", reference:"php53-pgsql-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"SL5", reference:"php53-process-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"SL5", reference:"php53-pspell-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"SL5", reference:"php53-snmp-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"SL5", reference:"php53-soap-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"SL5", reference:"php53-xml-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"SL5", reference:"php53-xmlrpc-5.3.3-1.el5_7.5")) flag++; if (rpm_check(release:"SL6", reference:"php-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"SL6", reference:"php-bcmath-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"SL6", reference:"php-cli-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"SL6", reference:"php-common-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"SL6", reference:"php-dba-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"SL6", reference:"php-debuginfo-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"SL6", reference:"php-devel-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"SL6", reference:"php-embedded-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"SL6", reference:"php-enchant-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"SL6", reference:"php-gd-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"SL6", reference:"php-imap-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"SL6", reference:"php-intl-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"SL6", reference:"php-ldap-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"SL6", reference:"php-mbstring-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"SL6", reference:"php-mysql-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"SL6", reference:"php-odbc-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"SL6", reference:"php-pdo-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"SL6", reference:"php-pgsql-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"SL6", reference:"php-process-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"SL6", reference:"php-pspell-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"SL6", reference:"php-recode-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"SL6", reference:"php-snmp-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"SL6", reference:"php-soap-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"SL6", reference:"php-tidy-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"SL6", reference:"php-xml-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"SL6", reference:"php-xmlrpc-5.3.3-3.el6_2.5")) flag++; if (rpm_check(release:"SL6", reference:"php-zts-5.3.3-3.el6_2.5")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_WARNING, extra : rpm_report_get() ); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "php / php-bcmath / php-cli / php-common / php-dba / php-debuginfo / etc"); }NASL family Scientific Linux Local Security Checks NASL id SL_20120118_PHP_ON_SL5_X.NASL description PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was found that the hashing routine used by PHP arrays was susceptible to predictable hash collisions. If an HTTP POST request to a PHP application contained many parameters whose names map to the same hash value, a large amount of CPU time would be consumed. This flaw has been mitigated by adding a new configuration directive, max_input_vars, that limits the maximum number of parameters processed per request. By default, max_input_vars is set to 1000. (CVE-2011-4885) A use-after-free flaw was found in the PHP substr_replace() function. If a PHP script used the same variable as multiple function arguments, a remote attacker could possibly use this to crash the PHP interpreter or, possibly, execute arbitrary code. (CVE-2011-1148) An integer overflow flaw was found in the PHP exif extension. On 32-bit systems, a specially crafted image file could cause the PHP interpreter to crash or disclose portions of its memory when a PHP script tries to extract Exchangeable image file format (Exif) metadata from the image file. (CVE-2011-4566) An insufficient input validation flaw, leading to a buffer over-read, was found in the PHP exif extension. A specially crafted image file could cause the PHP interpreter to crash when a PHP script tries to extract Exchangeable image file format (Exif) metadata from the image file. (CVE-2011-0708) An integer overflow flaw was found in the PHP calendar extension. A remote attacker able to make a PHP script call SdnToJulian() with a large value could cause the PHP interpreter to crash. (CVE-2011-1466) A bug in the PHP Streams component caused the PHP interpreter to crash if an FTP wrapper connection was made through an HTTP proxy. A remote attacker could possibly trigger this issue if a PHP script accepted an untrusted URL to connect to. (CVE-2011-1469) An off-by-one flaw was found in PHP. If an attacker uploaded a file with a specially crafted file name it could cause a PHP script to attempt to write a file to the root (/) directory. By default, PHP runs as the last seen 2020-03-18 modified 2012-08-01 plugin id 61220 published 2012-08-01 reporter This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/61220 title Scientific Linux Security Update : php on SL5.x i386/x86_64 (20120118) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text is (C) Scientific Linux. # include("compat.inc"); if (description) { script_id(61220); script_version("1.14"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/12"); script_cve_id("CVE-2011-0708", "CVE-2011-1148", "CVE-2011-1466", "CVE-2011-1469", "CVE-2011-2202", "CVE-2011-4566", "CVE-2011-4885"); script_name(english:"Scientific Linux Security Update : php on SL5.x i386/x86_64 (20120118)"); script_summary(english:"Checks rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value: "The remote Scientific Linux host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was found that the hashing routine used by PHP arrays was susceptible to predictable hash collisions. If an HTTP POST request to a PHP application contained many parameters whose names map to the same hash value, a large amount of CPU time would be consumed. This flaw has been mitigated by adding a new configuration directive, max_input_vars, that limits the maximum number of parameters processed per request. By default, max_input_vars is set to 1000. (CVE-2011-4885) A use-after-free flaw was found in the PHP substr_replace() function. If a PHP script used the same variable as multiple function arguments, a remote attacker could possibly use this to crash the PHP interpreter or, possibly, execute arbitrary code. (CVE-2011-1148) An integer overflow flaw was found in the PHP exif extension. On 32-bit systems, a specially crafted image file could cause the PHP interpreter to crash or disclose portions of its memory when a PHP script tries to extract Exchangeable image file format (Exif) metadata from the image file. (CVE-2011-4566) An insufficient input validation flaw, leading to a buffer over-read, was found in the PHP exif extension. A specially crafted image file could cause the PHP interpreter to crash when a PHP script tries to extract Exchangeable image file format (Exif) metadata from the image file. (CVE-2011-0708) An integer overflow flaw was found in the PHP calendar extension. A remote attacker able to make a PHP script call SdnToJulian() with a large value could cause the PHP interpreter to crash. (CVE-2011-1466) A bug in the PHP Streams component caused the PHP interpreter to crash if an FTP wrapper connection was made through an HTTP proxy. A remote attacker could possibly trigger this issue if a PHP script accepted an untrusted URL to connect to. (CVE-2011-1469) An off-by-one flaw was found in PHP. If an attacker uploaded a file with a specially crafted file name it could cause a PHP script to attempt to write a file to the root (/) directory. By default, PHP runs as the 'apache' user, preventing it from writing to the root directory. (CVE-2011-2202) All php users should upgrade to these updated packages, which contain backported patches to resolve these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect." ); # https://listserv.fnal.gov/scripts/wa.exe?A2=ind1201&L=scientific-linux-errata&T=0&P=1113 script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?14b6a8f7" ); script_set_attribute(attribute:"solution", value:"Update the affected packages."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"exploit_framework_core", value:"true"); script_set_attribute(attribute:"exploited_by_malware", value:"true"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-bcmath"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-cli"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-common"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-dba"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-gd"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-imap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-ldap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-mbstring"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-mysql"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-ncurses"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-odbc"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-pdo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-pgsql"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-snmp"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-soap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-xml"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-xmlrpc"); script_set_attribute(attribute:"cpe", value:"x-cpe:/o:fermilab:scientific_linux"); script_set_attribute(attribute:"vuln_publication_date", value:"2011/03/18"); script_set_attribute(attribute:"patch_publication_date", value:"2012/01/18"); script_set_attribute(attribute:"plugin_publication_date", value:"2012/08/01"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Scientific Linux Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/RedHat/release", "Host/RedHat/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("misc_func.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/RedHat/release"); if (isnull(release) || "Scientific Linux " >!< release) audit(AUDIT_HOST_NOT, "running Scientific Linux"); os_ver = pregmatch(pattern: "Scientific Linux.*release ([0-9]+(\.[0-9]+)?)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Scientific Linux"); os_ver = os_ver[1]; if (! preg(pattern:"^5([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Scientific Linux 5.x", "Scientific Linux " + os_ver); if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if (cpu >!< "x86_64" && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Scientific Linux", cpu); flag = 0; if (rpm_check(release:"SL5", reference:"php-5.1.6-27.el5_7.4")) flag++; if (rpm_check(release:"SL5", reference:"php-bcmath-5.1.6-27.el5_7.4")) flag++; if (rpm_check(release:"SL5", reference:"php-cli-5.1.6-27.el5_7.4")) flag++; if (rpm_check(release:"SL5", reference:"php-common-5.1.6-27.el5_7.4")) flag++; if (rpm_check(release:"SL5", reference:"php-dba-5.1.6-27.el5_7.4")) flag++; if (rpm_check(release:"SL5", reference:"php-debuginfo-5.1.6-27.el5_7.4")) flag++; if (rpm_check(release:"SL5", reference:"php-devel-5.1.6-27.el5_7.4")) flag++; if (rpm_check(release:"SL5", reference:"php-gd-5.1.6-27.el5_7.4")) flag++; if (rpm_check(release:"SL5", reference:"php-imap-5.1.6-27.el5_7.4")) flag++; if (rpm_check(release:"SL5", reference:"php-ldap-5.1.6-27.el5_7.4")) flag++; if (rpm_check(release:"SL5", reference:"php-mbstring-5.1.6-27.el5_7.4")) flag++; if (rpm_check(release:"SL5", reference:"php-mysql-5.1.6-27.el5_7.4")) flag++; if (rpm_check(release:"SL5", reference:"php-ncurses-5.1.6-27.el5_7.4")) flag++; if (rpm_check(release:"SL5", reference:"php-odbc-5.1.6-27.el5_7.4")) flag++; if (rpm_check(release:"SL5", reference:"php-pdo-5.1.6-27.el5_7.4")) flag++; if (rpm_check(release:"SL5", reference:"php-pgsql-5.1.6-27.el5_7.4")) flag++; if (rpm_check(release:"SL5", reference:"php-snmp-5.1.6-27.el5_7.4")) flag++; if (rpm_check(release:"SL5", reference:"php-soap-5.1.6-27.el5_7.4")) flag++; if (rpm_check(release:"SL5", reference:"php-xml-5.1.6-27.el5_7.4")) flag++; if (rpm_check(release:"SL5", reference:"php-xmlrpc-5.1.6-27.el5_7.4")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_HOLE, extra : rpm_report_get() ); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "php / php-bcmath / php-cli / php-common / php-dba / php-debuginfo / etc"); }NASL family CentOS Local Security Checks NASL id CENTOS_RHSA-2012-0071.NASL description Updated php packages that fix several security issues are now available for Red Hat Enterprise Linux 4. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was found that the hashing routine used by PHP arrays was susceptible to predictable hash collisions. If an HTTP POST request to a PHP application contained many parameters whose names map to the same hash value, a large amount of CPU time would be consumed. This flaw has been mitigated by adding a new configuration directive, max_input_vars, that limits the maximum number of parameters processed per request. By default, max_input_vars is set to 1000. (CVE-2011-4885) An integer overflow flaw was found in the PHP exif extension. On 32-bit systems, a specially crafted image file could cause the PHP interpreter to crash or disclose portions of its memory when a PHP script tries to extract Exchangeable image file format (Exif) metadata from the image file. (CVE-2011-4566) An insufficient input validation flaw, leading to a buffer over-read, was found in the PHP exif extension. A specially crafted image file could cause the PHP interpreter to crash when a PHP script tries to extract Exchangeable image file format (Exif) metadata from the image file. (CVE-2011-0708) An integer overflow flaw was found in the PHP calendar extension. A remote attacker able to make a PHP script call SdnToJulian() with a large value could cause the PHP interpreter to crash. (CVE-2011-1466) An off-by-one flaw was found in PHP. If an attacker uploaded a file with a specially crafted file name it could cause a PHP script to attempt to write a file to the root (/) directory. By default, PHP runs as the last seen 2020-06-01 modified 2020-06-02 plugin id 67087 published 2013-06-29 reporter This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/67087 title CentOS 4 : php (CESA-2012:0071) code # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Red Hat Security Advisory RHSA-2012:0071 and # CentOS Errata and Security Advisory 2012:0071 respectively. # include("compat.inc"); if (description) { script_id(67087); script_version("1.17"); script_cvs_date("Date: 2020/01/07"); script_cve_id("CVE-2011-0708", "CVE-2011-1466", "CVE-2011-2202", "CVE-2011-4566", "CVE-2011-4885"); script_bugtraq_id(46365, 46967, 48259, 49241, 50907, 51193); script_xref(name:"RHSA", value:"2012:0071"); script_name(english:"CentOS 4 : php (CESA-2012:0071)"); script_summary(english:"Checks rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value:"The remote CentOS host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "Updated php packages that fix several security issues are now available for Red Hat Enterprise Linux 4. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was found that the hashing routine used by PHP arrays was susceptible to predictable hash collisions. If an HTTP POST request to a PHP application contained many parameters whose names map to the same hash value, a large amount of CPU time would be consumed. This flaw has been mitigated by adding a new configuration directive, max_input_vars, that limits the maximum number of parameters processed per request. By default, max_input_vars is set to 1000. (CVE-2011-4885) An integer overflow flaw was found in the PHP exif extension. On 32-bit systems, a specially crafted image file could cause the PHP interpreter to crash or disclose portions of its memory when a PHP script tries to extract Exchangeable image file format (Exif) metadata from the image file. (CVE-2011-4566) An insufficient input validation flaw, leading to a buffer over-read, was found in the PHP exif extension. A specially crafted image file could cause the PHP interpreter to crash when a PHP script tries to extract Exchangeable image file format (Exif) metadata from the image file. (CVE-2011-0708) An integer overflow flaw was found in the PHP calendar extension. A remote attacker able to make a PHP script call SdnToJulian() with a large value could cause the PHP interpreter to crash. (CVE-2011-1466) An off-by-one flaw was found in PHP. If an attacker uploaded a file with a specially crafted file name it could cause a PHP script to attempt to write a file to the root (/) directory. By default, PHP runs as the 'apache' user, preventing it from writing to the root directory. (CVE-2011-2202) Red Hat would like to thank oCERT for reporting CVE-2011-4885. oCERT acknowledges Julian Walde and Alexander Klink as the original reporters of CVE-2011-4885. All php users should upgrade to these updated packages, which contain backported patches to resolve these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect." ); # https://lists.centos.org/pipermail/centos-announce/2012-January/018402.html script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?17087c14" ); script_set_attribute(attribute:"solution", value:"Update the affected php packages."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2011-2202"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"exploit_framework_core", value:"true"); script_set_attribute(attribute:"exploited_by_malware", value:"true"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:php"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:php-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:php-domxml"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:php-gd"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:php-imap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:php-ldap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:php-mbstring"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:php-mysql"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:php-ncurses"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:php-odbc"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:php-pear"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:php-pgsql"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:php-snmp"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:php-xmlrpc"); script_set_attribute(attribute:"cpe", value:"cpe:/o:centos:centos:4"); script_set_attribute(attribute:"vuln_publication_date", value:"2011/03/20"); script_set_attribute(attribute:"patch_publication_date", value:"2012/01/30"); script_set_attribute(attribute:"plugin_publication_date", value:"2013/06/29"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"CentOS Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/CentOS/release", "Host/CentOS/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/CentOS/release"); if (isnull(release) || "CentOS" >!< release) audit(AUDIT_OS_NOT, "CentOS"); os_ver = pregmatch(pattern: "CentOS(?: Linux)? release ([0-9]+)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "CentOS"); os_ver = os_ver[1]; if (! preg(pattern:"^4([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "CentOS 4.x", "CentOS " + os_ver); if (!get_kb_item("Host/CentOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && "ia64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "CentOS", cpu); flag = 0; if (rpm_check(release:"CentOS-4", cpu:"i386", reference:"php-4.3.9-3.35")) flag++; if (rpm_check(release:"CentOS-4", cpu:"x86_64", reference:"php-4.3.9-3.35")) flag++; if (rpm_check(release:"CentOS-4", cpu:"i386", reference:"php-devel-4.3.9-3.35")) flag++; if (rpm_check(release:"CentOS-4", cpu:"x86_64", reference:"php-devel-4.3.9-3.35")) flag++; if (rpm_check(release:"CentOS-4", cpu:"i386", reference:"php-domxml-4.3.9-3.35")) flag++; if (rpm_check(release:"CentOS-4", cpu:"x86_64", reference:"php-domxml-4.3.9-3.35")) flag++; if (rpm_check(release:"CentOS-4", cpu:"i386", reference:"php-gd-4.3.9-3.35")) flag++; if (rpm_check(release:"CentOS-4", cpu:"x86_64", reference:"php-gd-4.3.9-3.35")) flag++; if (rpm_check(release:"CentOS-4", cpu:"i386", reference:"php-imap-4.3.9-3.35")) flag++; if (rpm_check(release:"CentOS-4", cpu:"x86_64", reference:"php-imap-4.3.9-3.35")) flag++; if (rpm_check(release:"CentOS-4", cpu:"i386", reference:"php-ldap-4.3.9-3.35")) flag++; if (rpm_check(release:"CentOS-4", cpu:"x86_64", reference:"php-ldap-4.3.9-3.35")) flag++; if (rpm_check(release:"CentOS-4", cpu:"i386", reference:"php-mbstring-4.3.9-3.35")) flag++; if (rpm_check(release:"CentOS-4", cpu:"x86_64", reference:"php-mbstring-4.3.9-3.35")) flag++; if (rpm_check(release:"CentOS-4", cpu:"i386", reference:"php-mysql-4.3.9-3.35")) flag++; if (rpm_check(release:"CentOS-4", cpu:"x86_64", reference:"php-mysql-4.3.9-3.35")) flag++; if (rpm_check(release:"CentOS-4", cpu:"i386", reference:"php-ncurses-4.3.9-3.35")) flag++; if (rpm_check(release:"CentOS-4", cpu:"x86_64", reference:"php-ncurses-4.3.9-3.35")) flag++; if (rpm_check(release:"CentOS-4", cpu:"i386", reference:"php-odbc-4.3.9-3.35")) flag++; if (rpm_check(release:"CentOS-4", cpu:"x86_64", reference:"php-odbc-4.3.9-3.35")) flag++; if (rpm_check(release:"CentOS-4", cpu:"i386", reference:"php-pear-4.3.9-3.35")) flag++; if (rpm_check(release:"CentOS-4", cpu:"x86_64", reference:"php-pear-4.3.9-3.35")) flag++; if (rpm_check(release:"CentOS-4", cpu:"i386", reference:"php-pgsql-4.3.9-3.35")) flag++; if (rpm_check(release:"CentOS-4", cpu:"x86_64", reference:"php-pgsql-4.3.9-3.35")) flag++; if (rpm_check(release:"CentOS-4", cpu:"i386", reference:"php-snmp-4.3.9-3.35")) flag++; if (rpm_check(release:"CentOS-4", cpu:"x86_64", reference:"php-snmp-4.3.9-3.35")) flag++; if (rpm_check(release:"CentOS-4", cpu:"i386", reference:"php-xmlrpc-4.3.9-3.35")) flag++; if (rpm_check(release:"CentOS-4", cpu:"x86_64", reference:"php-xmlrpc-4.3.9-3.35")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_WARNING, extra : rpm_report_get() ); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "php / php-devel / php-domxml / php-gd / php-imap / php-ldap / etc"); }NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2012-0019.NASL description From Red Hat Security Advisory 2012:0019 : Updated php53 and php packages that fix two security issues are now available for Red Hat Enterprise Linux 5 and 6 respectively. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was found that the hashing routine used by PHP arrays was susceptible to predictable hash collisions. If an HTTP POST request to a PHP application contained many parameters whose names map to the same hash value, a large amount of CPU time would be consumed. This flaw has been mitigated by adding a new configuration directive, max_input_vars, that limits the maximum number of parameters processed per request. By default, max_input_vars is set to 1000. (CVE-2011-4885) An integer overflow flaw was found in the PHP exif extension. On 32-bit systems, a specially crafted image file could cause the PHP interpreter to crash or disclose portions of its memory when a PHP script tries to extract Exchangeable image file format (Exif) metadata from the image file. (CVE-2011-4566) Red Hat would like to thank oCERT for reporting CVE-2011-4885. oCERT acknowledges Julian Walde and Alexander Klink as the original reporters of CVE-2011-4885. All php53 and php users should upgrade to these updated packages, which contain backported patches to resolve these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect. last seen 2020-06-01 modified 2020-06-02 plugin id 68431 published 2013-07-12 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/68431 title Oracle Linux 5 / 6 : php / php53 (ELSA-2012-0019) NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-201209-03.NASL description The remote host is affected by the vulnerability described in GLSA-201209-03 (PHP: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in PHP. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could execute arbitrary code with the privileges of the process, cause a Denial of Service condition, obtain sensitive information, create arbitrary files, conduct directory traversal attacks, bypass protection mechanisms, or perform further attacks with unspecified impact. Workaround : There is no known workaround at this time. last seen 2020-06-01 modified 2020-06-02 plugin id 62236 published 2012-09-24 reporter This script is Copyright (C) 2012-2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/62236 title GLSA-201209-03 : PHP: Multiple vulnerabilities NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2012-0033.NASL description From Red Hat Security Advisory 2012:0033 : Updated php packages that fix several security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was found that the hashing routine used by PHP arrays was susceptible to predictable hash collisions. If an HTTP POST request to a PHP application contained many parameters whose names map to the same hash value, a large amount of CPU time would be consumed. This flaw has been mitigated by adding a new configuration directive, max_input_vars, that limits the maximum number of parameters processed per request. By default, max_input_vars is set to 1000. (CVE-2011-4885) A use-after-free flaw was found in the PHP substr_replace() function. If a PHP script used the same variable as multiple function arguments, a remote attacker could possibly use this to crash the PHP interpreter or, possibly, execute arbitrary code. (CVE-2011-1148) An integer overflow flaw was found in the PHP exif extension. On 32-bit systems, a specially crafted image file could cause the PHP interpreter to crash or disclose portions of its memory when a PHP script tries to extract Exchangeable image file format (Exif) metadata from the image file. (CVE-2011-4566) An insufficient input validation flaw, leading to a buffer over-read, was found in the PHP exif extension. A specially crafted image file could cause the PHP interpreter to crash when a PHP script tries to extract Exchangeable image file format (Exif) metadata from the image file. (CVE-2011-0708) An integer overflow flaw was found in the PHP calendar extension. A remote attacker able to make a PHP script call SdnToJulian() with a large value could cause the PHP interpreter to crash. (CVE-2011-1466) A bug in the PHP Streams component caused the PHP interpreter to crash if an FTP wrapper connection was made through an HTTP proxy. A remote attacker could possibly trigger this issue if a PHP script accepted an untrusted URL to connect to. (CVE-2011-1469) An off-by-one flaw was found in PHP. If an attacker uploaded a file with a specially crafted file name it could cause a PHP script to attempt to write a file to the root (/) directory. By default, PHP runs as the last seen 2020-06-01 modified 2020-06-02 plugin id 68432 published 2013-07-12 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/68432 title Oracle Linux 5 : php (ELSA-2012-0033) NASL family SuSE Local Security Checks NASL id OPENSUSE-2012-182.NASL description php5 security update last seen 2020-06-05 modified 2014-06-13 plugin id 74580 published 2014-06-13 reporter This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/74580 title openSUSE Security Update : php5 (openSUSE-SU-2012:0426-1) NASL family CGI abuses NASL id PHP_5_3_9.NASL description According to its banner, the version of PHP installed on the remote host is older than 5.3.9. As such, it may be affected by the following security issues : - The last seen 2020-06-01 modified 2020-06-02 plugin id 57537 published 2012-01-13 reporter This script is Copyright (C) 2012-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/57537 title PHP < 5.3.9 Multiple Vulnerabilities NASL family SuSE Local Security Checks NASL id SUSE_11_APACHE2-MOD_PHP5-120309.NASL description This update of php5 fixes multiple security flaws : - A php5 upload filename injection was fixed. (CVE-2011-2202) - A integer overflow in the EXIF extension was fixed that could be used by attackers to crash the interpreter or potentially read memory. (CVE-2011-4566) - Multiple NULL pointer dereferences were fixed that could lead to crashes. (CVE-2011-3182) - An integer overflow in the PHP calendar extension was fixed that could have led to crashes. (CVE-2011-1466) - A symlink vulnerability in the PEAR installer could be exploited by local attackers to inject code. (CVE-2011-1072) - missing checks of return values could allow remote attackers to cause a denial of service (NULL pointer dereference). (CVE-2011-4153) - denial of service via hash collisions. (CVE-2011-4885) - specially crafted XSLT stylesheets could allow remote attackers to create arbitrary files with arbitrary content. (CVE-2012-0057) - remote attackers can cause a denial of service via specially crafted input to an application that attempts to perform Tidy::diagnose operations. (CVE-2012-0781) - applications that use a PDO driver were prone to denial of service flaws which could be exploited remotely. (CVE-2012-0788) - memory leak in the timezone functionality could allow remote attackers to cause a denial of service (memory consumption). (CVE-2012-0789) - a stack-based buffer overflow in the php5 Suhosin extension could allow remote attackers to execute arbitrary code via a long string that is used in a Set-Cookie HTTP header. (CVE-2012-0807) - this fixes an incorrect fix for CVE-2011-4885 which could allow remote attackers to execute arbitrary code via a request containing a large number of variables. (CVE-2012-0830) - temporary changes to the magic_quotes_gpc directive during the importing of environment variables is not properly performed which makes it easier for remote attackers to conduct SQL injections. (CVE-2012-0831) Also the following bugs have been fixed : - allow uploading files bigger than 2GB for 64bit systems [bnc#709549] - amend README.SUSE to discourage using apache module with apache2-worker [bnc#728671] last seen 2020-06-05 modified 2012-04-13 plugin id 58740 published 2012-04-13 reporter This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/58740 title SuSE 11.1 Security Update : PHP5 (SAT Patch Number 5964) NASL family Mandriva Local Security Checks NASL id MANDRIVA_MDVSA-2011-197.NASL description Multiple vulnerabilities has been discovered and corrected in php : Integer overflow in the exif_process_IFD_TAG function in exif.c in the exif extension in PHP 5.4.0beta2 on 32-bit platforms allows remote attackers to read the contents of arbitrary memory locations or cause a denial of service via a crafted offset_val value in an EXIF header in a JPEG file, a different vulnerability than CVE-2011-0708 (CVE-2011-4566). PHP before 5.3.9 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters (CVE-2011-4885). The updated packages have been patched to correct this issue. last seen 2020-06-01 modified 2020-06-02 plugin id 57427 published 2012-01-03 reporter This script is Copyright (C) 2012-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/57427 title Mandriva Linux Security Advisory : php (MDVSA-2011:197) NASL family CentOS Local Security Checks NASL id CENTOS_RHSA-2012-0019.NASL description Updated php53 and php packages that fix two security issues are now available for Red Hat Enterprise Linux 5 and 6 respectively. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was found that the hashing routine used by PHP arrays was susceptible to predictable hash collisions. If an HTTP POST request to a PHP application contained many parameters whose names map to the same hash value, a large amount of CPU time would be consumed. This flaw has been mitigated by adding a new configuration directive, max_input_vars, that limits the maximum number of parameters processed per request. By default, max_input_vars is set to 1000. (CVE-2011-4885) An integer overflow flaw was found in the PHP exif extension. On 32-bit systems, a specially crafted image file could cause the PHP interpreter to crash or disclose portions of its memory when a PHP script tries to extract Exchangeable image file format (Exif) metadata from the image file. (CVE-2011-4566) Red Hat would like to thank oCERT for reporting CVE-2011-4885. oCERT acknowledges Julian Walde and Alexander Klink as the original reporters of CVE-2011-4885. All php53 and php users should upgrade to these updated packages, which contain backported patches to resolve these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect. last seen 2020-06-01 modified 2020-06-02 plugin id 57488 published 2012-01-12 reporter This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/57488 title CentOS 5 / 6 : php / php53 (CESA-2012:0019) NASL family Scientific Linux Local Security Checks NASL id SL_20120130_PHP_ON_SL4_X.NASL description PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was found that the hashing routine used by PHP arrays was susceptible to predictable hash collisions. If an HTTP POST request to a PHP application contained many parameters whose names map to the same hash value, a large amount of CPU time would be consumed. This flaw has been mitigated by adding a new configuration directive, max_input_vars, that limits the maximum number of parameters processed per request. By default, max_input_vars is set to 1000. (CVE-2011-4885) An integer overflow flaw was found in the PHP exif extension. On 32-bit systems, a specially crafted image file could cause the PHP interpreter to crash or disclose portions of its memory when a PHP script tries to extract Exchangeable image file format (Exif) metadata from the image file. (CVE-2011-4566) An insufficient input validation flaw, leading to a buffer over-read, was found in the PHP exif extension. A specially crafted image file could cause the PHP interpreter to crash when a PHP script tries to extract Exchangeable image file format (Exif) metadata from the image file. (CVE-2011-0708) An integer overflow flaw was found in the PHP calendar extension. A remote attacker able to make a PHP script call SdnToJulian() with a large value could cause the PHP interpreter to crash. (CVE-2011-1466) An off-by-one flaw was found in PHP. If an attacker uploaded a file with a specially crafted file name it could cause a PHP script to attempt to write a file to the root (/) directory. By default, PHP runs as the last seen 2020-03-18 modified 2012-08-01 plugin id 61227 published 2012-08-01 reporter This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/61227 title Scientific Linux Security Update : php on SL4.x i386/x86_64 (20120130) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2012-0071.NASL description Updated php packages that fix several security issues are now available for Red Hat Enterprise Linux 4. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was found that the hashing routine used by PHP arrays was susceptible to predictable hash collisions. If an HTTP POST request to a PHP application contained many parameters whose names map to the same hash value, a large amount of CPU time would be consumed. This flaw has been mitigated by adding a new configuration directive, max_input_vars, that limits the maximum number of parameters processed per request. By default, max_input_vars is set to 1000. (CVE-2011-4885) An integer overflow flaw was found in the PHP exif extension. On 32-bit systems, a specially crafted image file could cause the PHP interpreter to crash or disclose portions of its memory when a PHP script tries to extract Exchangeable image file format (Exif) metadata from the image file. (CVE-2011-4566) An insufficient input validation flaw, leading to a buffer over-read, was found in the PHP exif extension. A specially crafted image file could cause the PHP interpreter to crash when a PHP script tries to extract Exchangeable image file format (Exif) metadata from the image file. (CVE-2011-0708) An integer overflow flaw was found in the PHP calendar extension. A remote attacker able to make a PHP script call SdnToJulian() with a large value could cause the PHP interpreter to crash. (CVE-2011-1466) An off-by-one flaw was found in PHP. If an attacker uploaded a file with a specially crafted file name it could cause a PHP script to attempt to write a file to the root (/) directory. By default, PHP runs as the last seen 2020-04-16 modified 2012-01-31 plugin id 57748 published 2012-01-31 reporter This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/57748 title RHEL 4 : php (RHSA-2012:0071) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2012-0033.NASL description Updated php packages that fix several security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was found that the hashing routine used by PHP arrays was susceptible to predictable hash collisions. If an HTTP POST request to a PHP application contained many parameters whose names map to the same hash value, a large amount of CPU time would be consumed. This flaw has been mitigated by adding a new configuration directive, max_input_vars, that limits the maximum number of parameters processed per request. By default, max_input_vars is set to 1000. (CVE-2011-4885) A use-after-free flaw was found in the PHP substr_replace() function. If a PHP script used the same variable as multiple function arguments, a remote attacker could possibly use this to crash the PHP interpreter or, possibly, execute arbitrary code. (CVE-2011-1148) An integer overflow flaw was found in the PHP exif extension. On 32-bit systems, a specially crafted image file could cause the PHP interpreter to crash or disclose portions of its memory when a PHP script tries to extract Exchangeable image file format (Exif) metadata from the image file. (CVE-2011-4566) An insufficient input validation flaw, leading to a buffer over-read, was found in the PHP exif extension. A specially crafted image file could cause the PHP interpreter to crash when a PHP script tries to extract Exchangeable image file format (Exif) metadata from the image file. (CVE-2011-0708) An integer overflow flaw was found in the PHP calendar extension. A remote attacker able to make a PHP script call SdnToJulian() with a large value could cause the PHP interpreter to crash. (CVE-2011-1466) A bug in the PHP Streams component caused the PHP interpreter to crash if an FTP wrapper connection was made through an HTTP proxy. A remote attacker could possibly trigger this issue if a PHP script accepted an untrusted URL to connect to. (CVE-2011-1469) An off-by-one flaw was found in PHP. If an attacker uploaded a file with a specially crafted file name it could cause a PHP script to attempt to write a file to the root (/) directory. By default, PHP runs as the last seen 2020-04-16 modified 2012-01-19 plugin id 57594 published 2012-01-19 reporter This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/57594 title RHEL 5 : php (RHSA-2012:0033) NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-1307-1.NASL description Florent Hochwelker discovered that PHP incorrectly handled certain EXIF headers in JPEG files. A remote attacker could exploit this issue to view sensitive information or cause the PHP server to crash. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 57314 published 2011-12-15 reporter Ubuntu Security Notice (C) 2011-2019 Canonical, Inc. / NASL script (C) 2011-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/57314 title Ubuntu 8.04 LTS / 10.04 LTS / 10.10 / 11.04 / 11.10 : php5 vulnerability (USN-1307-1) NASL family Debian Local Security Checks NASL id DEBIAN_DSA-2399.NASL description Several vulnerabilities have been discovered in PHP, the web scripting language. The Common Vulnerabilities and Exposures project identifies the following issues : - CVE-2011-1938 The UNIX socket handling allowed attackers to trigger a buffer overflow via a long path name. - CVE-2011-2483 The crypt_blowfish function did not properly handle 8-bit characters, which made it easier for attackers to determine a cleartext password by using knowledge of a password hash. - CVE-2011-4566 When used on 32 bit platforms, the exif extension could be used to trigger an integer overflow in the exif_process_IFD_TAG function when processing a JPEG file. - CVE-2011-4885 It was possible to trigger hash collisions predictably when parsing form parameters, which allows remote attackers to cause a denial of service by sending many crafted parameters. - CVE-2012-0057 When applying a crafted XSLT transform, an attacker could write files to arbitrary places in the filesystem. NOTE: the fix for CVE-2011-2483 required changing the behaviour of this function: it is now incompatible with some old (wrongly) generated hashes for passwords containing 8-bit characters. See the package NEWS entry for details. This change has not been applied to the Lenny version of PHP. last seen 2020-03-17 modified 2012-02-01 plugin id 57753 published 2012-02-01 reporter This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/57753 title Debian DSA-2399-2 : php5 - several vulnerabilities NASL family F5 Networks Local Security Checks NASL id F5_BIGIP_SOL13519.NASL description PHP has been cited with the following multiple vulnerabilities, which may be locally exploitable on some F5 products : CVE-2006-7243 PHP before 5.3.4 accepts the \0 character in a pathname, which might allow context-dependent attackers to bypass intended access restrictions by placing a safe file extension after this character, as demonstrated by .php\0.jpg at the end of the argument to the file_exists function. CVE-2007-3799 The session_start function in ext/session in PHP 4.x up to 4.4.7 and 5.x up to 5.2.3 allows remote attackers to insert arbitrary attributes into the session cookie via special characters in a cookie that is obtained from (1) PATH_INFO, (2) the session_id function, and (3) the session_start function, which are not encoded or filtered when the new session cookie is generated, a related issue to CVE-2006-0207. CVE-2010-3710 Stack consumption vulnerability in the filter_var function in PHP 5.2.x through 5.2.14 and 5.3.x through 5.3.3, when FILTER_VALIDATE_EMAIL mode is used, allows remote attackers to cause a denial of service (memory consumption and application crash) via a long e-mail address string. CVE-2010-3870 The utf8_decode function in PHP before 5.3.4 does not properly handle non-shortest form UTF-8 encoding and ill-formed subsequences in UTF-8 data, which makes it easier for remote attackers to bypass cross-site scripting (XSS) and SQL injection protection mechanisms via a crafted string. CVE-2010-4697 Use-after-free vulnerability in the Zend engine in PHP before 5.2.15 and 5.3.x before 5.3.4 might allow context-dependent attackers to cause a denial of service (heap memory corruption) or have unspecified other impact via vectors related to use of __set, __get, __isset, and __unset methods on objects accessed by a reference. CVE-2011-1470 The Zip extension in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (application crash) via a ziparchive stream that is not properly handled by the stream_get_contents function. CVE-2011-3182 PHP before 5.3.7 does not properly check the return values of the malloc, calloc, and realloc library functions, which allows context-dependent attackers to cause a denial of service (NULL pointer dereference and application crash) or trigger a buffer overflow by leveraging the ability to provide an arbitrary value for a function argument, related to (1) ext/curl/interface.c, (2) ext/date/lib/parse_date.c, (3) ext/date/lib/parse_iso_intervals.c, (4) ext/date/lib/parse_tz.c, (5) ext/date/lib/timelib.c, (6) ext/pdo_odbc/pdo_odbc.c, (7) ext/reflection/php_reflection.c, (8) ext/soap/php_sdl.c, (9) ext/xmlrpc/libxmlrpc/base64.c, (10) TSRM/tsrm_win32.c, and (11) the strtotime function. CVE-2011-3267 PHP before 5.3.7 does not properly implement the error_log function, which allows context-dependent attackers to cause a denial of service (application crash) via unspecified vectors. CVE-2011-3268 Buffer overflow in the crypt function in PHP before 5.3.7 allows context-dependent attackers to have an unspecified impact via a long salt argument, a different vulnerability than CVE-2011-2483. CVE-2011-4566 Integer overflow in the exif_process_IFD_TAG function in exif.c in the exif extension in PHP 5.4.0beta2 on 32-bit platforms allows remote attackers to read the contents of arbitrary memory locations or cause a denial of service via a crafted offset_val value in an EXIF header in a JPEG file, a different vulnerability than CVE-2011-0708. CVE-2012-0830 The php_register_variable_ex function in php_variables.c in PHP 5.3.9 allows remote attackers to execute arbitrary code via a request containing a large number of variables, related to improper handling of array variables. NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-4885. last seen 2020-06-01 modified 2020-06-02 plugin id 78134 published 2014-10-10 reporter This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/78134 title F5 Networks BIG-IP : Multiple PHP vulnerabilities (K13519) NASL family Fedora Local Security Checks NASL id FEDORA_2012-0504.NASL description Security Enhancements and Fixes in PHP 5.3.9 : - Added max_input_vars directive to prevent attacks based on hash collisions. (CVE-2011-4885) - Fixed bug #60150 (Integer overflow during the parsing of invalid exif header). (CVE-2011-4566) Full upstream changelog : http://www.php.net/ChangeLog-5.php#5.3.9 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-03-17 modified 2012-01-20 plugin id 57609 published 2012-01-20 reporter This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/57609 title Fedora 16 : maniadrive-1.2-32.fc16.1 / php-5.3.9-1.fc16 / php-eaccelerator-0.9.6.1-9.fc16.1 (2012-0504) NASL family Fedora Local Security Checks NASL id FEDORA_2012-0420.NASL description Security Enhancements and Fixes in PHP 5.3.9 : - Added max_input_vars directive to prevent attacks based on hash collisions. (CVE-2011-4885) - Fixed bug #60150 (Integer overflow during the parsing of invalid exif header). (CVE-2011-4566) Full upstream changelog : http://www.php.net/ChangeLog-5.php#5.3.9 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-03-17 modified 2012-01-27 plugin id 57703 published 2012-01-27 reporter This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/57703 title Fedora 15 : maniadrive-1.2-32.fc15.1 / php-5.3.9-1.fc15 / php-eaccelerator-0.9.6.1-9.fc15.1 (2012-0420) NASL family CentOS Local Security Checks NASL id CENTOS_RHSA-2012-0033.NASL description Updated php packages that fix several security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was found that the hashing routine used by PHP arrays was susceptible to predictable hash collisions. If an HTTP POST request to a PHP application contained many parameters whose names map to the same hash value, a large amount of CPU time would be consumed. This flaw has been mitigated by adding a new configuration directive, max_input_vars, that limits the maximum number of parameters processed per request. By default, max_input_vars is set to 1000. (CVE-2011-4885) A use-after-free flaw was found in the PHP substr_replace() function. If a PHP script used the same variable as multiple function arguments, a remote attacker could possibly use this to crash the PHP interpreter or, possibly, execute arbitrary code. (CVE-2011-1148) An integer overflow flaw was found in the PHP exif extension. On 32-bit systems, a specially crafted image file could cause the PHP interpreter to crash or disclose portions of its memory when a PHP script tries to extract Exchangeable image file format (Exif) metadata from the image file. (CVE-2011-4566) An insufficient input validation flaw, leading to a buffer over-read, was found in the PHP exif extension. A specially crafted image file could cause the PHP interpreter to crash when a PHP script tries to extract Exchangeable image file format (Exif) metadata from the image file. (CVE-2011-0708) An integer overflow flaw was found in the PHP calendar extension. A remote attacker able to make a PHP script call SdnToJulian() with a large value could cause the PHP interpreter to crash. (CVE-2011-1466) A bug in the PHP Streams component caused the PHP interpreter to crash if an FTP wrapper connection was made through an HTTP proxy. A remote attacker could possibly trigger this issue if a PHP script accepted an untrusted URL to connect to. (CVE-2011-1469) An off-by-one flaw was found in PHP. If an attacker uploaded a file with a specially crafted file name it could cause a PHP script to attempt to write a file to the root (/) directory. By default, PHP runs as the last seen 2020-06-01 modified 2020-06-02 plugin id 57642 published 2012-01-24 reporter This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/57642 title CentOS 5 : php (CESA-2012:0033) NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2012-0071.NASL description From Red Hat Security Advisory 2012:0071 : Updated php packages that fix several security issues are now available for Red Hat Enterprise Linux 4. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was found that the hashing routine used by PHP arrays was susceptible to predictable hash collisions. If an HTTP POST request to a PHP application contained many parameters whose names map to the same hash value, a large amount of CPU time would be consumed. This flaw has been mitigated by adding a new configuration directive, max_input_vars, that limits the maximum number of parameters processed per request. By default, max_input_vars is set to 1000. (CVE-2011-4885) An integer overflow flaw was found in the PHP exif extension. On 32-bit systems, a specially crafted image file could cause the PHP interpreter to crash or disclose portions of its memory when a PHP script tries to extract Exchangeable image file format (Exif) metadata from the image file. (CVE-2011-4566) An insufficient input validation flaw, leading to a buffer over-read, was found in the PHP exif extension. A specially crafted image file could cause the PHP interpreter to crash when a PHP script tries to extract Exchangeable image file format (Exif) metadata from the image file. (CVE-2011-0708) An integer overflow flaw was found in the PHP calendar extension. A remote attacker able to make a PHP script call SdnToJulian() with a large value could cause the PHP interpreter to crash. (CVE-2011-1466) An off-by-one flaw was found in PHP. If an attacker uploaded a file with a specially crafted file name it could cause a PHP script to attempt to write a file to the root (/) directory. By default, PHP runs as the last seen 2020-06-01 modified 2020-06-02 plugin id 68442 published 2013-07-12 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/68442 title Oracle Linux 4 : php (ELSA-2012-0071) NASL family Amazon Linux Local Security Checks NASL id ALA_ALAS-2012-37.NASL description It was found that the hashing routine used by PHP arrays was susceptible to predictable hash collisions. If an HTTP POST request to a PHP application contained many parameters whose names map to the same hash value, a large amount of CPU time would be consumed. This flaw has been mitigated by adding a new configuration directive, max_input_vars, that limits the maximum number of parameters processed per request. By default, max_input_vars is set to 1000. (CVE-2011-4885) An integer overflow flaw was found in the PHP exif extension. On 32-bit systems, a specially crafted image file could cause the PHP interpreter to crash or disclose portions of its memory when a PHP script tries to extract Exchangeable image file format (Exif) metadata from the image file. (CVE-2011-4566) last seen 2020-06-01 modified 2020-06-02 plugin id 69644 published 2013-09-04 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/69644 title Amazon Linux AMI : php (ALAS-2012-37) NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_D39218103C8011E197E800215C6A37BB.NASL description php development team reports : Security Enhancements and Fixes in PHP 5.3.9 : - Added max_input_vars directive to prevent attacks based on hash collisions. (CVE-2011-4885) - Fixed bug #60150 (Integer overflow during the parsing of invalid exif header). (CVE-2011-4566) last seen 2020-06-01 modified 2020-06-02 plugin id 57489 published 2012-01-12 reporter This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/57489 title FreeBSD : php -- multiple vulnerabilities (d3921810-3c80-11e1-97e8-00215c6a37bb)
Redhat
| advisories |
| ||||||||
| rpms |
|
Seebug
| bulletinFamily | exploit |
| description | BUGTRAQ ID: 50907 CVE ID: CVE-2011-4566 PHP是一种在电脑上运行的脚本语言，主要用途是在于处理动态网页，包含了命令行运行接口或者产生图形用户界面程序。 PHP的实现上存在漏洞，在32位版本中，函数exif_process_IFD_TAG没有正确检验值offset_val，成功利用此漏洞可允许远程攻击者在受影响Web服务器中执行任意代码，可能会造成拒绝服务。 PHP 5.4.0 beta2 厂商补丁： PHP --- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.php.net |
| id | SSV:26018 |
| last seen | 2017-11-19 |
| modified | 2011-12-07 |
| published | 2011-12-07 |
| reporter | Root |
| source | https://www.seebug.org/vuldb/ssvid-26018 |
| title | PHP "exif_process_IFD_TAG()"远程整数溢出漏洞 |
References
- https://bugs.php.net/bug.php?id=60150
- http://www.securityfocus.com/bid/50907
- http://www.redhat.com/support/errata/RHSA-2012-0019.html
- http://www.debian.org/security/2012/dsa-2399
- http://support.apple.com/kb/HT5281
- http://lists.apple.com/archives/security-announce/2012/May/msg00001.html
- http://secunia.com/advisories/48668
- http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00016.html
- http://secunia.com/advisories/47253
- http://rhn.redhat.com/errata/RHSA-2012-0071.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:197
- https://www.ubuntu.com/usn/USN-1307-1/
- https://exchange.xforce.ibmcloud.com/vulnerabilities/71612