Vulnerabilities > CVE-2011-4718 - Permissions, Privileges, and Access Controls vulnerability in PHP

047910
CVSS 0.0 - NONE
Attack vector
UNKNOWN
Attack complexity
UNKNOWN
Privileges required
UNKNOWN
Confidentiality impact
UNKNOWN
Integrity impact
UNKNOWN
Availability impact
UNKNOWN
php
CWE-264
nessus

Summary

Session fixation vulnerability in the Sessions subsystem in PHP before 5.5.2 allows remote attackers to hijack web sessions by specifying a session ID.

Vulnerable Configurations

Part Description Count
Application
Php
628

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Accessing, Modifying or Executing Executable Files
    An attack of this type exploits a system's configuration that allows an attacker to either directly access an executable file, for example through shell access; or in a possible worst case allows an attacker to upload a file and then execute it. Web servers, ftp servers, and message oriented middleware systems which have many integration points are particularly vulnerable, because both the programmers and the administrators must be in synch regarding the interfaces and the correct privileges for each interface.
  • Leverage Executable Code in Non-Executable Files
    An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high. The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/) http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process. The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name "public" grants all users with the public role the ability to use the administration functionality. The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
  • Blue Boxing
    This type of attack against older telephone switches and trunks has been around for decades. A tone is sent by an adversary to impersonate a supervisor signal which has the effect of rerouting or usurping command of the line. While the US infrastructure proper may not contain widespread vulnerabilities to this type of attack, many companies are connected globally through call centers and business process outsourcing. These international systems may be operated in countries which have not upgraded Telco infrastructure and so are vulnerable to Blue boxing. Blue boxing is a result of failure on the part of the system to enforce strong authorization for administrative functions. While the infrastructure is different than standard current applications like web applications, there are historical lessons to be learned to upgrade the access control for administrative functions.
  • Restful Privilege Elevation
    Rest uses standard HTTP (Get, Put, Delete) style permissions methods, but these are not necessarily correlated generally with back end programs. Strict interpretation of HTTP get methods means that these HTTP Get services should not be used to delete information on the server, but there is no access control mechanism to back up this logic. This means that unless the services are properly ACL'd and the application's service implementation are following these guidelines then an HTTP request can easily execute a delete or update on the server side. The attacker identifies a HTTP Get URL such as http://victimsite/updateOrder, which calls out to a program to update orders on a database or other resource. The URL is not idempotent so the request can be submitted multiple times by the attacker, additionally, the attacker may be able to exploit the URL published as a Get method that actually performs updates (instead of merely retrieving data). This may result in malicious or inadvertent altering of data on the server.
  • Target Programs with Elevated Privileges
    This attack targets programs running with elevated privileges. The attacker would try to leverage a bug in the running program and get arbitrary code to execute with elevated privileges. For instance an attacker would look for programs that write to the system directories or registry keys (such as HKLM, which stores a number of critical Windows environment variables). These programs are typically running with elevated privileges and have usually not been designed with security in mind. Such programs are excellent exploit targets because they yield lots of power when they break. The malicious user try to execute its code at the same level as a privileged system call.

Nessus

  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-2546.NASL
    descriptionAccording to the versions of the php packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Session fixation vulnerability in the Sessions subsystem in PHP before 5.5.2 allows remote attackers to hijack web sessions by specifying a session ID.(CVE-2011-4718) - In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.(CVE-2019-11043) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-05-08
    modified2019-12-09
    plugin id131820
    published2019-12-09
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/131820
    titleEulerOS 2.0 SP5 : php (EulerOS-SA-2019-2546)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(131820);
      script_version("1.5");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/05/07");
    
      script_cve_id(
        "CVE-2011-4718",
        "CVE-2019-11043"
      );
      script_bugtraq_id(
        61929
      );
    
      script_name(english:"EulerOS 2.0 SP5 : php (EulerOS-SA-2019-2546)");
      script_summary(english:"Checks the rpm output for the updated packages.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote EulerOS host is missing multiple security updates.");
      script_set_attribute(attribute:"description", value:
    "According to the versions of the php packages installed, the EulerOS
    installation on the remote host is affected by the following
    vulnerabilities :
    
      - Session fixation vulnerability in the Sessions
        subsystem in PHP before 5.5.2 allows remote attackers
        to hijack web sessions by specifying a session
        ID.(CVE-2011-4718)
    
      - In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24
        and 7.3.x below 7.3.11 in certain configurations of FPM
        setup it is possible to cause FPM module to write past
        allocated buffers into the space reserved for FCGI
        protocol data, thus opening the possibility of remote
        code execution.(CVE-2019-11043)
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the EulerOS security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues.");
      # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2019-2546
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?02bff10d");
      script_set_attribute(attribute:"solution", value:
    "Update the affected php packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'PHP-FPM Underflow RCE');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2019/12/09");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/12/09");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:php");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:php-cli");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:php-common");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:php-gd");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:php-ldap");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:php-mysql");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:php-odbc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:php-pdo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:php-pgsql");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:php-process");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:php-recode");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:php-soap");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:php-xml");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:php-xmlrpc");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Huawei Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp");
      script_exclude_keys("Host/EulerOS/uvp_version");
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    
    release = get_kb_item("Host/EulerOS/release");
    if (isnull(release) || release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
    if (release !~ "^EulerOS release 2\.0(\D|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0");
    
    sp = get_kb_item("Host/EulerOS/sp");
    if (isnull(sp) || sp !~ "^(5)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP5");
    
    uvp = get_kb_item("Host/EulerOS/uvp_version");
    if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP5", "EulerOS UVP " + uvp);
    
    if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_ARCH_NOT, "i686 / x86_64", cpu);
    
    flag = 0;
    
    pkgs = ["php-5.4.16-45.h21.eulerosv2r7",
            "php-cli-5.4.16-45.h21.eulerosv2r7",
            "php-common-5.4.16-45.h21.eulerosv2r7",
            "php-gd-5.4.16-45.h21.eulerosv2r7",
            "php-ldap-5.4.16-45.h21.eulerosv2r7",
            "php-mysql-5.4.16-45.h21.eulerosv2r7",
            "php-odbc-5.4.16-45.h21.eulerosv2r7",
            "php-pdo-5.4.16-45.h21.eulerosv2r7",
            "php-pgsql-5.4.16-45.h21.eulerosv2r7",
            "php-process-5.4.16-45.h21.eulerosv2r7",
            "php-recode-5.4.16-45.h21.eulerosv2r7",
            "php-soap-5.4.16-45.h21.eulerosv2r7",
            "php-xml-5.4.16-45.h21.eulerosv2r7",
            "php-xmlrpc-5.4.16-45.h21.eulerosv2r7"];
    
    foreach (pkg in pkgs)
      if (rpm_check(release:"EulerOS-2.0", sp:"5", reference:pkg)) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "php");
    }
    
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2013-14998.NASL
    descriptionVersion 5.5.3, 22 Aug 2013 Openssl: + Fixed UMR in fix for CVE-2013-4248. Version 5.5.2, 15-Aug-2013 Core : - Fixed bug #65372 (Segfault in gc_zval_possible_root when return reference fails). - Fixed value of FILTER_SANITIZE_FULL_SPECIAL_CHARS constant (previously was erroneously set to FILTER_SANITIZE_SPECIAL_CHARS value). - Fixed bug #65304 (Use of max int in array_sum). - Fixed bug #65291 (get_defined_constants() causes PHP to crash in a very limited case). - Fixed bug #62691 (solaris sed has no -i switch). - Fixed bug #61345 (CGI mode - make install don
    last seen2020-03-17
    modified2013-08-25
    plugin id69462
    published2013-08-25
    reporterThis script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/69462
    titleFedora 19 : php-5.5.3-1.fc19 (2013-14998)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Fedora Security Advisory 2013-14998.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(69462);
      script_version("1.11");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/12");
    
      script_cve_id("CVE-2011-4718", "CVE-2013-4248");
      script_bugtraq_id(61776, 61929);
      script_xref(name:"FEDORA", value:"2013-14998");
    
      script_name(english:"Fedora 19 : php-5.5.3-1.fc19 (2013-14998)");
      script_summary(english:"Checks rpm output for the updated package.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Fedora host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Version 5.5.3, 22 Aug 2013
    
    Openssl: + Fixed UMR in fix for CVE-2013-4248.
    
    Version 5.5.2, 15-Aug-2013
    
    Core :
    
      - Fixed bug #65372 (Segfault in gc_zval_possible_root when
        return reference fails).
    
        - Fixed value of FILTER_SANITIZE_FULL_SPECIAL_CHARS
          constant (previously was erroneously set to
          FILTER_SANITIZE_SPECIAL_CHARS value).
    
        - Fixed bug #65304 (Use of max int in array_sum).
    
        - Fixed bug #65291 (get_defined_constants() causes PHP
          to crash in a very limited case).
    
        - Fixed bug #62691 (solaris sed has no -i switch).
    
        - Fixed bug #61345 (CGI mode - make install don't work).
    
        - Fixed bug #61268 (--enable-dtrace leads make to
          clobber Zend/zend_dtrace.d).
    
    DOM :
    
      - Added flags option to DOMDocument::schemaValidate() and
        DOMDocument::schemaValidateSource(). Added
        LIBXML_SCHEMA_CREATE flag.
    
    OPcache :
    
      - Added opcache.restrict_api configuration directive that
        may limit usage of OPcahce API functions only to
        patricular script(s).
    
        - Added support for glob symbols in blacklist entries
          (?, *, **).
    
        - Fixed bug #65338 (Enabling both php_opcache and
          php_wincache AVs on shutdown).
    
    Openssl :
    
      - Fixed handling null bytes in subjectAltName
        (CVE-2013-4248).
    
    PDO_mysql :
    
      - Fixed bug #65299 (pdo mysql parsing errors).
    
    Phar :
    
      - Fixed bug #65028 (Phar::buildFromDirectory creates
        corrupt archives for some specific contents).
    
    Pgsql :
    
      - Fixed bug #62978 (Disallow possible SQL injections with
        pg_select()/pg_update() /pg_delete()/pg_insert()).
    
        - Fixed bug #65336 (pg_escape_literal/identifier()
          silently returns false).
    
    Sessions :
    
      - Implemented strict sessions RFC
        (https://wiki.php.net/rfc/strict_sessions) which
        protects against session fixation attacks and session
        collisions (CVE-2011-4718).
    
        - Fixed possible buffer overflow under Windows. Note:
          Not a security fix.
    
        - Changed session.auto_start to PHP_INI_PERDIR.
    
    SOAP :
    
      - Fixed bug #65018 (SoapHeader problems with SoapServer).
    
    SPL :
    
      - Fixed bug #65328 (Segfault when getting SplStack object
        Value).
    
        - Added RecursiveTreeIterator setPostfix and getPostifx
          methods.
    
        - Fixed bug #61697 (spl_autoload_functions returns
          lambda functions incorrectly).
    
    Streams :
    
      - Fixed bug #65268 (select() implementation uses outdated
        tick API).
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Fedora security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.redhat.com/show_bug.cgi?id=996774"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.redhat.com/show_bug.cgi?id=997097"
      );
      # https://lists.fedoraproject.org/pipermail/package-announce/2013-August/114648.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?cad3df9a"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://wiki.php.net/rfc/strict_sessions"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected php package.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:php");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:19");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2013/08/19");
      script_set_attribute(attribute:"plugin_publication_date", value:"2013/08/25");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Fedora Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
    os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
    os_ver = os_ver[1];
    if (! ereg(pattern:"^19([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 19.x", "Fedora " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);
    
    flag = 0;
    if (rpm_check(release:"FC19", reference:"php-5.5.3-1.fc19")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "php");
    }
    
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-2649.NASL
    descriptionAccording to the versions of the php packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - ** DISPUTED ** Integer overflow in the php_raw_url_encode function in ext/standard/url.c in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allows remote attackers to cause a denial of service (application crash) via a long string to the rawurlencode function. NOTE: the vendor says
    last seen2020-05-08
    modified2019-12-18
    plugin id132184
    published2019-12-18
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/132184
    titleEulerOS 2.0 SP3 : php (EulerOS-SA-2019-2649)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(132184);
      script_version("1.5");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/05/07");
    
      script_cve_id(
        "CVE-2011-4718",
        "CVE-2014-9767",
        "CVE-2014-9912",
        "CVE-2015-4116",
        "CVE-2015-5589",
        "CVE-2015-6831",
        "CVE-2015-6832",
        "CVE-2015-6833",
        "CVE-2015-7803",
        "CVE-2015-7804",
        "CVE-2015-8835",
        "CVE-2015-8866",
        "CVE-2015-8874",
        "CVE-2015-8879",
        "CVE-2015-8935",
        "CVE-2016-10158",
        "CVE-2016-10159",
        "CVE-2016-10161",
        "CVE-2016-10397",
        "CVE-2016-2554",
        "CVE-2016-3141",
        "CVE-2016-3142",
        "CVE-2016-3185",
        "CVE-2016-4070",
        "CVE-2016-4539",
        "CVE-2016-4540",
        "CVE-2016-4541",
        "CVE-2016-4542",
        "CVE-2016-4543",
        "CVE-2016-5093",
        "CVE-2016-5094",
        "CVE-2016-6288",
        "CVE-2016-6291",
        "CVE-2016-6292",
        "CVE-2016-6294",
        "CVE-2016-7124",
        "CVE-2016-7125",
        "CVE-2016-7128",
        "CVE-2016-7411",
        "CVE-2016-7412",
        "CVE-2016-7414",
        "CVE-2016-7418",
        "CVE-2016-7480",
        "CVE-2016-9934",
        "CVE-2016-9935",
        "CVE-2017-11143",
        "CVE-2017-11144",
        "CVE-2017-11147",
        "CVE-2017-11628",
        "CVE-2017-12933",
        "CVE-2017-16642",
        "CVE-2017-7272",
        "CVE-2017-9224",
        "CVE-2017-9226",
        "CVE-2017-9227",
        "CVE-2017-9228",
        "CVE-2017-9229",
        "CVE-2018-10545",
        "CVE-2018-10547",
        "CVE-2018-14851",
        "CVE-2018-17082",
        "CVE-2018-5711",
        "CVE-2018-5712",
        "CVE-2019-11043"
      );
      script_bugtraq_id(
        61929,
        75974
      );
    
      script_name(english:"EulerOS 2.0 SP3 : php (EulerOS-SA-2019-2649)");
      script_summary(english:"Checks the rpm output for the updated packages.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote EulerOS host is missing multiple security updates.");
      script_set_attribute(attribute:"description", value:
    "According to the versions of the php packages installed, the EulerOS
    installation on the remote host is affected by the following
    vulnerabilities :
    
      - ** DISPUTED ** Integer overflow in the
        php_raw_url_encode function in ext/standard/url.c in
        PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before
        7.0.5 allows remote attackers to cause a denial of
        service (application crash) via a long string to the
        rawurlencode function. NOTE: the vendor says 'Not sure
        if this qualifies as security issue (probably
        not).'(CVE-2016-4070)
    
      - An issue was discovered in ext/phar/phar_object.c in
        PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before
        7.1.17, and 7.2.x before 7.2.5. There is Reflected XSS
        on the PHAR 403 and 404 error pages via request data of
        a request for a .phar file. NOTE: this vulnerability
        exists because of an incomplete fix for
        CVE-2018-5712.(CVE-2018-10547)
    
      - An issue was discovered in Oniguruma 6.2.0, as used in
        Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP
        through 7.1.5. A heap out-of-bounds write occurs in
        bitset_set_range() during regular expression
        compilation due to an uninitialized variable from an
        incorrect state transition. An incorrect state
        transition in parse_char_class() could create an
        execution path that leaves a critical local variable
        uninitialized until it's used as an index, resulting in
        an out-of-bounds write memory
        corruption.(CVE-2017-9228)
    
      - An issue was discovered in Oniguruma 6.2.0, as used in
        Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP
        through 7.1.5. A heap out-of-bounds write or read
        occurs in next_state_val() during regular expression
        compilation. Octal numbers larger than 0xff are not
        handled correctly in fetch_token() and
        fetch_token_in_cc(). A malformed regular expression
        containing an octal number in the form of '\700' would
        produce an invalid code point value larger than 0xff in
        next_state_val(), resulting in an out-of-bounds write
        memory corruption.(CVE-2017-9226)
    
      - An issue was discovered in Oniguruma 6.2.0, as used in
        Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP
        through 7.1.5. A SIGSEGV occurs in
        left_adjust_char_head() during regular expression
        compilation. Invalid handling of reg->dmax in
        forward_search_range() could result in an invalid
        pointer dereference, normally as an immediate
        denial-of-service condition.(CVE-2017-9229)
    
      - An issue was discovered in Oniguruma 6.2.0, as used in
        Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP
        through 7.1.5. A stack out-of-bounds read occurs in
        match_at() during regular expression searching. A
        logical error involving order of validation and access
        in match_at() could result in an out-of-bounds read
        from a stack buffer.(CVE-2017-9224)
    
      - An issue was discovered in Oniguruma 6.2.0, as used in
        Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP
        through 7.1.5. A stack out-of-bounds read occurs in
        mbc_enc_len() during regular expression searching.
        Invalid handling of reg->dmin in forward_search_range()
        could result in an invalid pointer dereference, as an
        out-of-bounds read from a stack buffer.(CVE-2017-9227)
    
      - An issue was discovered in PHP before 5.6.33, 7.0.x
        before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before
        7.2.1. There is Reflected XSS on the PHAR 404 error
        page via the URI of a request for a .phar
        file.(CVE-2018-5712)
    
      - An issue was discovered in PHP before 5.6.35, 7.0.x
        before 7.0.29, 7.1.x before 7.1.16, and 7.2.x before
        7.2.4. Dumpable FPM child processes allow bypassing
        opcache access controls because fpm_unix.c makes a
        PR_SET_DUMPABLE prctl call, allowing one user (in a
        multiuser environment) to obtain sensitive information
        from the process memory of a second user's PHP
        applications by running gcore on the PID of the PHP-FPM
        worker process.(CVE-2018-10545)
    
      - Directory traversal vulnerability in the PharData class
        in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x
        before 5.6.12 allows remote attackers to write to
        arbitrary files via a .. (dot dot) in a ZIP archive
        entry that is mishandled during an extractTo
        call.(CVE-2015-6833)
    
      - Directory traversal vulnerability in the
        ZipArchive::extractTo function in ext/zip/php_zip.c in
        PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x
        before 5.6.13 and ext/zip/ext_zip.cpp in HHVM before
        3.12.1 allows remote attackers to create arbitrary
        empty directories via a crafted ZIP
        archive.(CVE-2014-9767)
    
      - exif_process_IFD_in_MAKERNOTE in ext/exif/exif.c in PHP
        before 5.6.37, 7.0.x before 7.0.31, 7.1.x before
        7.1.20, and 7.2.x before 7.2.8 allows remote attackers
        to cause a denial of service (out-of-bounds read and
        application crash) via a crafted JPEG
        file.(CVE-2018-14851)
    
      - ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x
        before 5.6.6, when PHP-FPM is used, does not isolate
        each thread from libxml_disable_entity_loader changes
        in other threads, which allows remote attackers to
        conduct XML External Entity (XXE) and XML Entity
        Expansion (XEE) attacks via a crafted XML document, a
        related issue to CVE-2015-5161.(CVE-2015-8866)
    
      - ext/mysqlnd/mysqlnd_wireprotocol.c in PHP before 5.6.26
        and 7.x before 7.0.11 does not verify that a BIT field
        has the UNSIGNED_FLAG flag, which allows remote MySQL
        servers to cause a denial of service (heap-based buffer
        overflow) or possibly have unspecified other impact via
        crafted field metadata.(CVE-2016-7412)
    
      - ext/session/session.c in PHP before 5.6.25 and 7.x
        before 7.0.10 skips invalid session names in a way that
        triggers incorrect parsing, which allows remote
        attackers to inject arbitrary-type session data by
        leveraging control of a session name, as demonstrated
        by object injection.(CVE-2016-7125)
    
      - ext/standard/var_unserializer.c in PHP before 5.6.25
        and 7.x before 7.0.10 mishandles certain invalid
        objects, which allows remote attackers to cause a
        denial of service or possibly have unspecified other
        impact via crafted serialized data that leads to a (1)
        __destruct call or (2) magic method
        call.(CVE-2016-7124)
    
      - ext/standard/var_unserializer.re in PHP before 5.6.26
        mishandles object-deserialization failures, which
        allows remote attackers to cause a denial of service
        (memory corruption) or possibly have unspecified other
        impact via an unserialize call that references a
        partially constructed object.(CVE-2016-7411)
    
      - ext/wddx/wddx.c in PHP before 5.6.28 and 7.x before
        7.0.13 allows remote attackers to cause a denial of
        service (NULL pointer dereference) via crafted
        serialized data in a wddxPacket XML document, as
        demonstrated by a PDORow string.(CVE-2016-9934)
    
      - gd_gif_in.c in the GD Graphics Library (aka libgd), as
        used in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x
        before 7.1.13, and 7.2.x before 7.2.1, has an integer
        signedness error that leads to an infinite loop via a
        crafted GIF file, as demonstrated by a call to the
        imagecreatefromgif or imagecreatefromstring PHP
        function. This is related to GetCode_ and
        gdImageCreateFromGifCtx.(CVE-2018-5711)
    
      - In PHP before 5.6.28 and 7.x before 7.0.13, incorrect
        handling of various URI components in the URL parser
        could be used by attackers to bypass hostname-specific
        URL checks, as demonstrated by
        evil.example.com:80#@good.example.com/ and
        evil.example.com:[email protected]/ inputs to the
        parse_url function (implemented in the php_url_parse_ex
        function in ext/standard/url.c).(CVE-2016-10397)
    
      - In PHP before 5.6.30 and 7.x before 7.0.15, the PHAR
        archive handler could be used by attackers supplying
        malicious archive files to crash the PHP interpreter or
        potentially disclose information due to a buffer
        over-read in the phar_parse_pharfile function in
        ext/phar/phar.c.(CVE-2017-11147)
    
      - In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x
        before 7.1.7, a stack-based buffer overflow in the
        zend_ini_do_op() function in Zend/zend_ini_parser.c
        could cause a denial of service or potentially allow
        executing code. NOTE: this is only relevant for PHP
        applications that accept untrusted input (instead of
        the system's php.ini file) for the parse_ini_string or
        parse_ini_file function, e.g., a web application for
        syntax validation of php.ini
        directives.(CVE-2017-11628)
    
      - In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x
        before 7.1.7, the openssl extension PEM sealing code
        did not check the return value of the OpenSSL sealing
        function, which could lead to a crash of the PHP
        interpreter, related to an interpretation conflict for
        a negative number in ext/openssl/openssl.c, and an
        OpenSSL documentation omission.(CVE-2017-11144)
    
      - In PHP before 5.6.31, an invalid free in the WDDX
        deserialization of boolean parameters could be used by
        attackers able to inject XML for deserialization to
        crash the PHP interpreter, related to an invalid free
        for an empty boolean element in
        ext/wddx/wddx.c.(CVE-2017-11143)
    
      - In PHP before 5.6.32, 7.x before 7.0.25, and 7.1.x
        before 7.1.11, an error in the date extension's
        timelib_meridian handling of 'front of' and 'back of'
        directives could be used by attackers able to supply
        date strings to leak information from the interpreter,
        related to ext/date/lib/parse_date.c out-of-bounds
        reads affecting the php_parse_date function. NOTE: this
        is a different issue than
        CVE-2017-11145.(CVE-2017-16642)
    
      - In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24
        and 7.3.x below 7.3.11 in certain configurations of FPM
        setup it is possible to cause FPM module to write past
        allocated buffers into the space reserved for FCGI
        protocol data, thus opening the possibility of remote
        code execution.(CVE-2019-11043)
    
      - Integer overflow in the phar_parse_pharfile function in
        ext/phar/phar.c in PHP before 5.6.30 and 7.0.x before
        7.0.15 allows remote attackers to cause a denial of
        service (memory consumption or application crash) via a
        truncated manifest entry in a PHAR
        archive.(CVE-2016-10159)
    
      - Integer overflow in the php_html_entities function in
        ext/standard/html.c in PHP before 5.5.36 and 5.6.x
        before 5.6.22 allows remote attackers to cause a denial
        of service or possibly have unspecified other impact by
        triggering a large output string from the
        htmlspecialchars function.(CVE-2016-5094)
    
      - Multiple use-after-free vulnerabilities in SPL in PHP
        before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before
        5.6.12 allow remote attackers to execute arbitrary code
        via vectors involving (1) ArrayObject, (2)
        SplObjectStorage, and (3) SplDoublyLinkedList, which
        are mishandled during unserialization.(CVE-2015-6831)
    
      - Off-by-one error in the phar_parse_zipfile function in
        ext/phar/zip.c in PHP before 5.5.30 and 5.6.x before
        5.6.14 allows remote attackers to cause a denial of
        service (uninitialized pointer dereference and
        application crash) by including the / filename in a
        .zip PHAR archive.(CVE-2015-7804)
    
      - PHP through 7.1.11 enables potential SSRF in
        applications that accept an fsockopen or pfsockopen
        hostname argument with an expectation that the port
        number is constrained. Because a :port syntax is
        recognized, fsockopen will use the port number that is
        specified in the hostname argument, instead of the port
        number in the second argument of the
        function.(CVE-2017-7272)
    
      - Session fixation vulnerability in the Sessions
        subsystem in PHP before 5.5.2 allows remote attackers
        to hijack web sessions by specifying a session
        ID.(CVE-2011-4718)
    
      - Stack consumption vulnerability in GD in PHP before
        5.6.12 allows remote attackers to cause a denial of
        service via a crafted imagefilltoborder
        call.(CVE-2015-8874)
    
      - Stack-based buffer overflow in ext/phar/tar.c in PHP
        before 5.5.32, 5.6.x before 5.6.18, and 7.x before
        7.0.3 allows remote attackers to cause a denial of
        service (application crash) or possibly have
        unspecified other impact via a crafted TAR
        archive.(CVE-2016-2554)
    
      - The Apache2 component in PHP before 5.6.38, 7.0.x
        before 7.0.32, 7.1.x before 7.1.22, and 7.2.x before
        7.2.10 allows XSS via the body of a 'Transfer-Encoding:
        chunked' request, because the bucket brigade is
        mishandled in the php_handler function in
        sapi/apache2handler/sapi_apache2.c.(CVE-2018-17082)
    
      - The exif_convert_any_to_int function in ext/exif/exif.c
        in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x
        before 7.1.1 allows remote attackers to cause a denial
        of service (application crash) via crafted EXIF data
        that triggers an attempt to divide the minimum
        representable negative integer by -1.(CVE-2016-10158)
    
      - The exif_process_IFD_in_JPEG function in
        ext/exif/exif.c in PHP before 5.5.35, 5.6.x before
        5.6.21, and 7.x before 7.0.6 does not validate IFD
        sizes, which allows remote attackers to cause a denial
        of service (out-of-bounds read) or possibly have
        unspecified other impact via crafted header
        data.(CVE-2016-4543)
    
      - The exif_process_IFD_in_MAKERNOTE function in
        ext/exif/exif.c in PHP before 5.5.38, 5.6.x before
        5.6.24, and 7.x before 7.0.9 allows remote attackers to
        cause a denial of service (out-of-bounds array access
        and memory corruption), obtain sensitive information
        from process memory, or possibly have unspecified other
        impact via a crafted JPEG image.(CVE-2016-6291)
    
      - The exif_process_IFD_in_TIFF function in
        ext/exif/exif.c in PHP before 5.6.25 and 7.x before
        7.0.10 mishandles the case of a thumbnail offset that
        exceeds the file size, which allows remote attackers to
        obtain sensitive information from process memory via a
        crafted TIFF image.(CVE-2016-7128)
    
      - The exif_process_IFD_TAG function in ext/exif/exif.c in
        PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before
        7.0.6 does not properly construct spprintf arguments,
        which allows remote attackers to cause a denial of
        service (out-of-bounds read) or possibly have
        unspecified other impact via crafted header
        data.(CVE-2016-4542)
    
      - The exif_process_user_comment function in
        ext/exif/exif.c in PHP before 5.5.38, 5.6.x before
        5.6.24, and 7.x before 7.0.9 allows remote attackers to
        cause a denial of service (NULL pointer dereference and
        application crash) via a crafted JPEG
        image.(CVE-2016-6292)
    
      - The finish_nested_data function in
        ext/standard/var_unserializer.re in PHP before 5.6.31,
        7.0.x before 7.0.21, and 7.1.x before 7.1.7 is prone to
        a buffer over-read while unserializing untrusted data.
        Exploitation of this issue can have an unspecified
        impact on the integrity of PHP.(CVE-2017-12933)
    
      - The get_icu_disp_value_src_php function in
        ext/intl/locale/locale_methods.c in PHP before 5.3.29,
        5.4.x before 5.4.30, and 5.5.x before 5.5.14 does not
        properly restrict calls to the ICU uresbund.cpp
        component, which allows remote attackers to cause a
        denial of service (buffer overflow) or possibly have
        unspecified other impact via a locale_get_display_name
        call with a long first argument.(CVE-2014-9912)
    
      - The get_icu_value_internal function in
        ext/intl/locale/locale_methods.c in PHP before 5.5.36,
        5.6.x before 5.6.22, and 7.x before 7.0.7 does not
        ensure the presence of a '\0' character, which allows
        remote attackers to cause a denial of service
        (out-of-bounds read) or possibly have unspecified other
        impact via a crafted locale_get_primary_language
        call.(CVE-2016-5093)
    
      - The grapheme_stripos function in
        ext/intl/grapheme/grapheme_string.c in PHP before
        5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6
        allows remote attackers to cause a denial of service
        (out-of-bounds read) or possibly have unspecified other
        impact via a negative offset.(CVE-2016-4540)
    
      - The grapheme_strpos function in
        ext/intl/grapheme/grapheme_string.c in PHP before
        5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6
        allows remote attackers to cause a denial of service
        (out-of-bounds read) or possibly have unspecified other
        impact via a negative offset.(CVE-2016-4541)
    
      - The locale_accept_from_http function in
        ext/intl/locale/locale_methods.c in PHP before 5.5.38,
        5.6.x before 5.6.24, and 7.x before 7.0.9 does not
        properly restrict calls to the ICU
        uloc_acceptLanguageFromHTTP function, which allows
        remote attackers to cause a denial of service
        (out-of-bounds read) or possibly have unspecified other
        impact via a call with a long argument.(CVE-2016-6294)
    
      - The make_http_soap_request function in
        ext/soap/php_http.c in PHP before 5.4.44, 5.5.x before
        5.5.28, 5.6.x before 5.6.12, and 7.x before 7.0.4
        allows remote attackers to obtain sensitive information
        from process memory or cause a denial of service (type
        confusion and application crash) via crafted serialized
        _cookies data, related to the SoapClient::__call method
        in ext/soap/soap.c.(CVE-2016-3185)
    
      - The make_http_soap_request function in
        ext/soap/php_http.c in PHP before 5.4.44, 5.5.x before
        5.5.28, and 5.6.x before 5.6.12 does not properly
        retrieve keys, which allows remote attackers to cause a
        denial of service (NULL pointer dereference, type
        confusion, and application crash) or possibly execute
        arbitrary code via crafted serialized data representing
        a numerically indexed _cookies array, related to the
        SoapClient::__call method in
        ext/soap/soap.c.(CVE-2015-8835)
    
      - The object_common1 function in
        ext/standard/var_unserializer.c in PHP before 5.6.30,
        7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows
        remote attackers to cause a denial of service (buffer
        over-read and application crash) via crafted serialized
        data that is mishandled in a finish_nested_data
        call.(CVE-2016-10161)
    
      - The odbc_bindcols function in ext/odbc/php_odbc.c in
        PHP before 5.6.12 mishandles driver behavior for
        SQL_WVARCHAR columns, which allows remote attackers to
        cause a denial of service (application crash) in
        opportunistic circumstances by leveraging use of the
        odbc_fetch_array function to access a certain type of
        Microsoft SQL Server table.(CVE-2015-8879)
    
      - The phar_convert_to_other function in
        ext/phar/phar_object.c in PHP before 5.4.43, 5.5.x
        before 5.5.27, and 5.6.x before 5.6.11 does not
        validate a file pointer before a close operation, which
        allows remote attackers to cause a denial of service
        (segmentation fault) or possibly have unspecified other
        impact via a crafted TAR archive that is mishandled in
        a Phar::convertToData call.(CVE-2015-5589)
    
      - The phar_get_entry_data function in ext/phar/util.c in
        PHP before 5.5.30 and 5.6.x before 5.6.14 allows remote
        attackers to cause a denial of service (NULL pointer
        dereference and application crash) via a .phar file
        with a crafted TAR archive entry in which the Link
        indicator references a file that does not
        exist.(CVE-2015-7803)
    
      - The phar_parse_zipfile function in zip.c in the PHAR
        extension in PHP before 5.5.33 and 5.6.x before 5.6.19
        allows remote attackers to obtain sensitive information
        from process memory or cause a denial of service
        (out-of-bounds read and application crash) by placing a
        PK\x05\x06 signature at an invalid
        location.(CVE-2016-3142)
    
      - The php_url_parse_ex function in ext/standard/url.c in
        PHP before 5.5.38 allows remote attackers to cause a
        denial of service (buffer over-read) or possibly have
        unspecified other impact via vectors involving the
        smart_str data type.(CVE-2016-6288)
    
      - The php_wddx_push_element function in ext/wddx/wddx.c
        in PHP before 5.6.26 and 7.x before 7.0.11 allows
        remote attackers to cause a denial of service (invalid
        pointer access and out-of-bounds read) or possibly have
        unspecified other impact via an incorrect boolean
        element in a wddxPacket XML document, leading to
        mishandling in a wddx_deserialize call.(CVE-2016-7418)
    
      - The php_wddx_push_element function in ext/wddx/wddx.c
        in PHP before 5.6.29 and 7.x before 7.0.14 allows
        remote attackers to cause a denial of service
        (out-of-bounds read and memory corruption) or possibly
        have unspecified other impact via an empty boolean
        element in a wddxPacket XML document.(CVE-2016-9935)
    
      - The sapi_header_op function in main/SAPI.c in PHP
        before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before
        5.6.6 supports deprecated line folding without
        considering browser compatibility, which allows remote
        attackers to conduct cross-site scripting (XSS) attacks
        against Internet Explorer by leveraging (1) %0A%20 or
        (2) %0D%0A%20 mishandling in the header
        function.(CVE-2015-8935)
    
      - The SplObjectStorage unserialize implementation in
        ext/spl/spl_observer.c in PHP before 7.0.12 does not
        verify that a key is an object, which allows remote
        attackers to execute arbitrary code or cause a denial
        of service (uninitialized memory access) via crafted
        serialized data.(CVE-2016-7480)
    
      - The xml_parse_into_struct function in ext/xml/xml.c in
        PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before
        7.0.6 allows remote attackers to cause a denial of
        service (buffer under-read and segmentation fault) or
        possibly have unspecified other impact via crafted XML
        data in the second argument, leading to a parser level
        of zero.(CVE-2016-4539)
    
      - The ZIP signature-verification feature in PHP before
        5.6.26 and 7.x before 7.0.11 does not ensure that the
        uncompressed_filesize field is large enough, which
        allows remote attackers to cause a denial of service
        (out-of-bounds memory access) or possibly have
        unspecified other impact via a crafted PHAR archive,
        related to ext/phar/util.c and
        ext/phar/zip.c.(CVE-2016-7414)
    
      - Use-after-free vulnerability in the SPL unserialize
        implementation in ext/spl/spl_array.c in PHP before
        5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12
        allows remote attackers to execute arbitrary code via
        crafted serialized data that triggers misuse of an
        array field.(CVE-2015-6832)
    
      - Use-after-free vulnerability in the spl_ptr_heap_insert
        function in ext/spl/spl_heap.c in PHP before 5.5.27 and
        5.6.x before 5.6.11 allows remote attackers to execute
        arbitrary code by triggering a failed
        SplMinHeap::compare operation.(CVE-2015-4116)
    
      - Use-after-free vulnerability in wddx.c in the WDDX
        extension in PHP before 5.5.33 and 5.6.x before 5.6.19
        allows remote attackers to cause a denial of service
        (memory corruption and application crash) or possibly
        have unspecified other impact by triggering a
        wddx_deserialize call on XML data containing a crafted
        var element.(CVE-2016-3141)
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the EulerOS security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues.");
      # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2019-2649
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?cd44f4b5");
      script_set_attribute(attribute:"solution", value:
    "Update the affected php packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'PHP-FPM Underflow RCE');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2019/12/18");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/12/18");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:php");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:php-cli");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:php-common");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:php-gd");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:php-ldap");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:php-mysql");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:php-odbc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:php-pdo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:php-pgsql");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:php-process");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:php-recode");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:php-soap");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:php-xml");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:php-xmlrpc");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Huawei Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp");
      script_exclude_keys("Host/EulerOS/uvp_version");
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    
    release = get_kb_item("Host/EulerOS/release");
    if (isnull(release) || release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
    if (release !~ "^EulerOS release 2\.0(\D|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0");
    
    sp = get_kb_item("Host/EulerOS/sp");
    if (isnull(sp) || sp !~ "^(3)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP3");
    
    uvp = get_kb_item("Host/EulerOS/uvp_version");
    if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP3", "EulerOS UVP " + uvp);
    
    if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_ARCH_NOT, "i686 / x86_64", cpu);
    
    flag = 0;
    
    pkgs = ["php-5.4.16-42.h51",
            "php-cli-5.4.16-42.h51",
            "php-common-5.4.16-42.h51",
            "php-gd-5.4.16-42.h51",
            "php-ldap-5.4.16-42.h51",
            "php-mysql-5.4.16-42.h51",
            "php-odbc-5.4.16-42.h51",
            "php-pdo-5.4.16-42.h51",
            "php-pgsql-5.4.16-42.h51",
            "php-process-5.4.16-42.h51",
            "php-recode-5.4.16-42.h51",
            "php-soap-5.4.16-42.h51",
            "php-xml-5.4.16-42.h51",
            "php-xmlrpc-5.4.16-42.h51"];
    
    foreach (pkg in pkgs)
      if (rpm_check(release:"EulerOS-2.0", sp:"3", reference:pkg)) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "php");
    }
    
  • NASL familyAmazon Linux Local Security Checks
    NASL idALA_ALAS-2013-224.NASL
    descriptionSession fixation vulnerability in the Sessions subsystem in PHP before 5.5.2 allows remote attackers to hijack web sessions by specifying a session ID. The openssl_x509_parse function in openssl.c in the OpenSSL module in PHP before 5.4.18 and 5.5.x before 5.5.2 does not properly handle a
    last seen2020-06-01
    modified2020-06-02
    plugin id70228
    published2013-10-01
    reporterThis script is Copyright (C) 2013-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/70228
    titleAmazon Linux AMI : php54 (ALAS-2013-224)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Amazon Linux AMI Security Advisory ALAS-2013-224.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(70228);
      script_version("1.7");
      script_cvs_date("Date: 2018/04/18 15:09:35");
    
      script_cve_id("CVE-2011-4718", "CVE-2013-4248");
      script_xref(name:"ALAS", value:"2013-224");
    
      script_name(english:"Amazon Linux AMI : php54 (ALAS-2013-224)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Amazon Linux AMI host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Session fixation vulnerability in the Sessions subsystem in PHP before
    5.5.2 allows remote attackers to hijack web sessions by specifying a
    session ID.
    
    The openssl_x509_parse function in openssl.c in the OpenSSL module in
    PHP before 5.4.18 and 5.5.x before 5.5.2 does not properly handle a
    '\0' character in a domain name in the Subject Alternative Name field
    of an X.509 certificate, which allows man-in-the-middle attackers to
    spoof arbitrary SSL servers via a crafted certificate issued by a
    legitimate Certification Authority, a related issue to CVE-2009-2408 ."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://alas.aws.amazon.com/ALAS-2013-224.html"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Run 'yum update php54' to update your system."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php54");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php54-bcmath");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php54-cli");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php54-common");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php54-dba");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php54-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php54-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php54-embedded");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php54-enchant");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php54-fpm");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php54-gd");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php54-imap");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php54-intl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php54-ldap");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php54-mbstring");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php54-mcrypt");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php54-mssql");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php54-mysql");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php54-mysqlnd");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php54-odbc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php54-pdo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php54-pgsql");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php54-process");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php54-pspell");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php54-recode");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php54-snmp");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php54-soap");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php54-tidy");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php54-xml");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php54-xmlrpc");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:amazon:linux");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2013/09/19");
      script_set_attribute(attribute:"plugin_publication_date", value:"2013/10/01");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2013-2018 Tenable Network Security, Inc.");
      script_family(english:"Amazon Linux Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/AmazonLinux/release", "Host/AmazonLinux/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    
    release = get_kb_item("Host/AmazonLinux/release");
    if (isnull(release) || !strlen(release)) audit(AUDIT_OS_NOT, "Amazon Linux");
    os_ver = pregmatch(pattern: "^AL(A|\d)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Amazon Linux");
    os_ver = os_ver[1];
    if (os_ver != "A")
    {
      if (os_ver == 'A') os_ver = 'AMI';
      audit(AUDIT_OS_NOT, "Amazon Linux AMI", "Amazon Linux " + os_ver);
    }
    
    if (!get_kb_item("Host/AmazonLinux/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (rpm_check(release:"ALA", reference:"php54-5.4.19-1.42.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"php54-bcmath-5.4.19-1.42.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"php54-cli-5.4.19-1.42.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"php54-common-5.4.19-1.42.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"php54-dba-5.4.19-1.42.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"php54-debuginfo-5.4.19-1.42.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"php54-devel-5.4.19-1.42.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"php54-embedded-5.4.19-1.42.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"php54-enchant-5.4.19-1.42.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"php54-fpm-5.4.19-1.42.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"php54-gd-5.4.19-1.42.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"php54-imap-5.4.19-1.42.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"php54-intl-5.4.19-1.42.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"php54-ldap-5.4.19-1.42.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"php54-mbstring-5.4.19-1.42.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"php54-mcrypt-5.4.19-1.42.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"php54-mssql-5.4.19-1.42.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"php54-mysql-5.4.19-1.42.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"php54-mysqlnd-5.4.19-1.42.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"php54-odbc-5.4.19-1.42.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"php54-pdo-5.4.19-1.42.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"php54-pgsql-5.4.19-1.42.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"php54-process-5.4.19-1.42.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"php54-pspell-5.4.19-1.42.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"php54-recode-5.4.19-1.42.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"php54-snmp-5.4.19-1.42.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"php54-soap-5.4.19-1.42.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"php54-tidy-5.4.19-1.42.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"php54-xml-5.4.19-1.42.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"php54-xmlrpc-5.4.19-1.42.amzn1")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "php54 / php54-bcmath / php54-cli / php54-common / php54-dba / etc");
    }
    
  • NASL familySolaris Local Security Checks
    NASL idSOLARIS11_PHP_20140401.NASL
    descriptionThe remote Solaris system is missing necessary patches to address security updates : - Session fixation vulnerability in the Sessions subsystem in PHP before 5.5.2 allows remote attackers to hijack web sessions by specifying a session ID. (CVE-2011-4718) - Unspecified vulnerability in the _php_stream_scandir function in the stream implementation in PHP before 5.3.15 and 5.4.x before 5.4.5 has unknown impact and remote attack vectors, related to an
    last seen2020-06-01
    modified2020-06-02
    plugin id80736
    published2015-01-19
    reporterThis script is Copyright (C) 2015-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/80736
    titleOracle Solaris Third-Party Patch Update : php (cve_2013_4113_buffer_errors)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from the Oracle Third Party software advisories.
    #
    include("compat.inc");
    
    if (description)
    {
      script_id(80736);
      script_version("1.4");
      script_cvs_date("Date: 2018/11/15 20:50:25");
    
      script_cve_id("CVE-2011-4718", "CVE-2012-2688", "CVE-2012-3365", "CVE-2013-1635", "CVE-2013-1643", "CVE-2013-2110", "CVE-2013-4113", "CVE-2013-4248", "CVE-2013-4635", "CVE-2013-4636");
    
      script_name(english:"Oracle Solaris Third-Party Patch Update : php (cve_2013_4113_buffer_errors)");
      script_summary(english:"Check for the 'entire' version.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Solaris system is missing a security patch for third-party
    software."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "The remote Solaris system is missing necessary patches to address
    security updates :
    
      - Session fixation vulnerability in the Sessions subsystem
        in PHP before 5.5.2 allows remote attackers to hijack
        web sessions by specifying a session ID. (CVE-2011-4718)
    
      - Unspecified vulnerability in the _php_stream_scandir
        function in the stream implementation in PHP before
        5.3.15 and 5.4.x before 5.4.5 has unknown impact and
        remote attack vectors, related to an 'overflow.'
        (CVE-2012-2688)
    
      - The SQLite functionality in PHP before 5.3.15 allows
        remote attackers to bypass the open_basedir protection
        mechanism via unspecified vectors. (CVE-2012-3365)
    
      - ext/soap/soap.c in PHP before 5.3.22 and 5.4.x before
        5.4.13 does not validate the relationship between the
        soap.wsdl_cache_dir directive and the open_basedir
        directive, which allows remote attackers to bypass
        intended access restrictions by triggering the creation
        of cached SOAP WSDL files in an arbitrary directory.
        (CVE-2013-1635)
    
      - The SOAP parser in PHP before 5.3.23 and 5.4.x before
        5.4.13 allows remote attackers to read arbitrary files
        via a SOAP WSDL file containing an XML external entity
        declaration in conjunction with an entity reference,
        related to an XML External Entity (XXE) issue in the
        soap_xmlParseFile and soap_xmlParseMemory functions.
        NOTE: this vulnerability exists because of an incorrect
        fix for CVE-2013-1824. (CVE-2013-1643)
    
      - Heap-based buffer overflow in the php_quot_print_encode
        function in ext/ standard/quot_print.c in PHP before
        5.3.26 and 5.4.x before 5.4.16 allows remote attackers
        to cause a denial of service (application crash) or
        possibly have unspecified other impact via a crafted
        argument to the quoted_printable_encode function.
        (CVE-2013-2110)
    
      - ext/xml/xml.c in PHP before 5.3.27 does not properly
        consider parsing depth, which allows remote attackers to
        cause a denial of service (heap memory corruption) or
        possibly have unspecified other impact via a crafted
        document that is processed by the xml_parse_into_struct
        function. (CVE-2013-4113)
    
      - The openssl_x509_parse function in openssl.c in the
        OpenSSL module in PHP before 5.4.18 and 5.5.x before
        5.5.2 does not properly handle a '\0' character in a
        domain name in the Subject Alternative Name field of an
        X.509 certificate, which allows man-in-the-middle
        attackers to spoof arbitrary SSL servers via a crafted
        certificate issued by a legitimate Certification
        Authority, a related issue to CVE-2009-2408.
        (CVE-2013-4248)
    
      - Integer overflow in the SdnToJewish function in jewish.c
        in the Calendar component in PHP before 5.3.26 and 5.4.x
        before 5.4.16 allows context-dependent attackers to
        cause a denial of service (application hang) via a large
        argument to the jdtojewish function. (CVE-2013-4635)
    
      - The mget function in libmagic/softmagic.c in the
        Fileinfo component in PHP 5.4.x before 5.4.16 allows
        remote attackers to cause a denial of service (invalid
        pointer dereference and application crash) via an MP3
        file that triggers incorrect MIME type detection during
        access to an finfo object. (CVE-2013-4636)"
      );
      # https://www.oracle.com/technetwork/topics/security/thirdparty-patch-map-1482893.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?4a913f44"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://blogs.oracle.com/sunsecurity/cve-2013-4113-buffer-errors-vulnerability-in-php"
      );
      # https://blogs.oracle.com/sunsecurity/multiple-vulnerabilities-in-php
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?b4abfefa"
      );
      # https://blogs.oracle.com/sunsecurity/multiple-vulnerabilities-in-php1
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?b4abfefa"
      );
      # https://blogs.oracle.com/sunsecurity/multiple-vulnerabilities-in-php2
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?b4abfefa"
      );
      script_set_attribute(attribute:"solution", value:"Upgrade to Solaris 11.1.17.5.0.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:solaris:11.1");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:solaris:php");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2014/04/01");
      script_set_attribute(attribute:"plugin_publication_date", value:"2015/01/19");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2015-2018 Tenable Network Security, Inc.");
      script_family(english:"Solaris Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Solaris11/release", "Host/Solaris11/pkg-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("solaris.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/Solaris11/release");
    if (isnull(release)) audit(AUDIT_OS_NOT, "Solaris11");
    pkg_list = solaris_pkg_list_leaves();
    if (isnull (pkg_list)) audit(AUDIT_PACKAGE_LIST_MISSING, "Solaris pkg-list packages");
    
    if (empty_or_null(egrep(string:pkg_list, pattern:"^php$"))) audit(AUDIT_PACKAGE_NOT_INSTALLED, "php");
    
    flag = 0;
    
    if (solaris_check_release(release:"0.5.11-0.175.1.17.0.5.0", sru:"SRU 11.1.17.5.0") > 0) flag++;
    
    if (flag)
    {
      error_extra = 'Affected package : php\n' + solaris_get_report2();
      error_extra = ereg_replace(pattern:"version", replace:"OS version", string:error_extra);
      if (report_verbosity > 0) security_hole(port:0, extra:error_extra);
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_PACKAGE_NOT_AFFECTED, "php");
    
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201408-11.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201408-11 (PHP: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in PHP. Please review the CVE identifiers referenced below for details. Impact : A context-dependent attacker can cause arbitrary code execution, create a Denial of Service condition, read or write arbitrary files, impersonate other servers, hijack a web session, or have other unspecified impact. Additionally, a local attacker could gain escalated privileges. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id77455
    published2014-08-30
    reporterThis script is Copyright (C) 2014-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/77455
    titleGLSA-201408-11 : PHP: Multiple vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Gentoo Linux Security Advisory GLSA 201408-11.
    #
    # The advisory text is Copyright (C) 2001-2017 Gentoo Foundation, Inc.
    # and licensed under the Creative Commons - Attribution / Share Alike 
    # license. See http://creativecommons.org/licenses/by-sa/3.0/
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(77455);
      script_version("1.13");
      script_cvs_date("Date: 2018/07/12 19:01:15");
    
      script_cve_id("CVE-2011-4718", "CVE-2013-1635", "CVE-2013-1643", "CVE-2013-1824", "CVE-2013-2110", "CVE-2013-3735", "CVE-2013-4113", "CVE-2013-4248", "CVE-2013-4635", "CVE-2013-4636", "CVE-2013-6420", "CVE-2013-6712", "CVE-2013-7226", "CVE-2013-7327", "CVE-2013-7345", "CVE-2014-0185", "CVE-2014-0237", "CVE-2014-0238", "CVE-2014-1943", "CVE-2014-2270", "CVE-2014-2497", "CVE-2014-3597", "CVE-2014-3981", "CVE-2014-4049", "CVE-2014-4670", "CVE-2014-5120");
      script_bugtraq_id(58224, 58766, 60411, 60728, 60731, 61128, 61776, 61929, 62373, 64018, 64225, 65533, 65596, 65668, 66002, 66233, 66406, 67118, 67759, 67765, 67837, 68007, 68513, 69322, 69375);
      script_xref(name:"GLSA", value:"201408-11");
    
      script_name(english:"GLSA-201408-11 : PHP: Multiple vulnerabilities");
      script_summary(english:"Checks for updated package(s) in /var/db/pkg");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Gentoo host is missing one or more security-related
    patches."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "The remote host is affected by the vulnerability described in GLSA-201408-11
    (PHP: Multiple vulnerabilities)
    
        Multiple vulnerabilities have been discovered in PHP. Please review the
          CVE identifiers referenced below for details.
      
    Impact :
    
        A context-dependent attacker can cause arbitrary code execution, create
          a Denial of Service condition, read or write arbitrary files, impersonate
          other servers, hijack a web session, or have other unspecified impact.
          Additionally, a local attacker could gain escalated privileges.
      
    Workaround :
    
        There is no known workaround at this time."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security.gentoo.org/glsa/201408-11"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "All PHP 5.5 users should upgrade to the latest version:
          # emerge --sync
          # emerge --ask --oneshot --verbose '>=dev-lang/php-5.5.16'
        All PHP 5.4 users should upgrade to the latest version:
          # emerge --sync
          # emerge --ask --oneshot --verbose '>=dev-lang/php-5.4.32'
        All PHP 5.3 users should upgrade to the latest version. This release
          marks the end of life of the PHP 5.3 series. Future releases of this
          series are not planned. All PHP 5.3 users are encouraged to upgrade to
          the current stable version of PHP 5.5 or previous stable version of PHP
          5.4, which are supported till at least 2016 and 2015 respectively.
          # emerge --sync
          # emerge --ask --oneshot --verbose '>=dev-lang/php-5.3.29'"
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:php");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2014/08/29");
      script_set_attribute(attribute:"plugin_publication_date", value:"2014/08/30");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2014-2018 Tenable Network Security, Inc.");
      script_family(english:"Gentoo Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("qpkg.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo");
    if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    
    if (qpkg_check(package:"dev-lang/php", unaffected:make_list("ge 5.5.16", "rge 5.4.32", "rge 5.3.29", "rge 5.4.34", "rge 5.4.35", "rge 5.4.36", "rge 5.4.37", "rge 5.4.38", "rge 5.4.39", "rge 5.4.40", "rge 5.4.41", "rge 5.4.42", "rge 5.4.43", "rge 5.4.44", "rge 5.4.45", "rge 5.4.46"), vulnerable:make_list("lt 5.5.16"))) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = qpkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "PHP");
    }
    
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-2438.NASL
    descriptionAccording to the versions of the php packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.(CVE-2019-11043) - The finish_nested_data function in ext/standard/var_unserializer.re in PHP before 5.6.31, 7.0.x before 7.0.21, and 7.1.x before 7.1.7 is prone to a buffer over-read while unserializing untrusted data. Exploitation of this issue can have an unspecified impact on the integrity of PHP.(CVE-2017-12933) - ext/standard/var_unserializer.c in PHP before 5.6.25 and 7.x before 7.0.10 mishandles certain invalid objects, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data that leads to a (1) __destruct call or (2) magic method call.(CVE-2016-7124) - The match function in pcre_exec.c in PCRE before 8.37 mishandles the /(?:((abcd))|(((?:(?:(?:(?:abc|(?:abcdef))))b)abcdefghi )abc)|((*ACCEPT)))/ pattern and related patterns involving (*ACCEPT), which allows remote attackers to obtain sensitive information from process memory or cause a denial of service (partially initialized memory and application crash) via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, aka ZDI-CAN-2547.(CVE-2015-8382) - An issue was discovered in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1. There is Reflected XSS on the PHAR 404 error page via the URI of a request for a .phar file.(CVE-2018-5712) - exif_process_IFD_in_MAKERNOTE in ext/exif/exif.c in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before 7.2.8 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted JPEG file.(CVE-2018-14851) - The SplObjectStorage unserialize implementation in ext/spl/spl_observer.c in PHP before 7.0.12 does not verify that a key is an object, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access) via crafted serialized data.(CVE-2016-7480) - ext/standard/var_unserializer.re in PHP before 5.6.26 mishandles object-deserialization failures, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via an unserialize call that references a partially constructed object.(CVE-2016-7411) - The odbc_bindcols function in ext/odbc/php_odbc.c in PHP before 5.6.12 mishandles driver behavior for SQL_WVARCHAR columns, which allows remote attackers to cause a denial of service (application crash) in opportunistic circumstances by leveraging use of the odbc_fetch_array function to access a certain type of Microsoft SQL Server table.(CVE-2015-8879) - In PHP before 5.6.32, 7.x before 7.0.25, and 7.1.x before 7.1.11, an error in the date extension
    last seen2020-05-08
    modified2019-12-04
    plugin id131592
    published2019-12-04
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/131592
    titleEulerOS 2.0 SP2 : php (EulerOS-SA-2019-2438)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(131592);
      script_version("1.5");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/05/07");
    
      script_cve_id(
        "CVE-2011-4718",
        "CVE-2014-9767",
        "CVE-2014-9912",
        "CVE-2015-5589",
        "CVE-2015-6831",
        "CVE-2015-6832",
        "CVE-2015-6833",
        "CVE-2015-7803",
        "CVE-2015-7804",
        "CVE-2015-8382",
        "CVE-2015-8835",
        "CVE-2015-8867",
        "CVE-2015-8874",
        "CVE-2015-8879",
        "CVE-2015-8935",
        "CVE-2016-10397",
        "CVE-2016-2554",
        "CVE-2016-3141",
        "CVE-2016-3142",
        "CVE-2016-3185",
        "CVE-2016-4070",
        "CVE-2016-4539",
        "CVE-2016-4540",
        "CVE-2016-4541",
        "CVE-2016-4542",
        "CVE-2016-4543",
        "CVE-2016-5093",
        "CVE-2016-5094",
        "CVE-2016-6288",
        "CVE-2016-6291",
        "CVE-2016-6292",
        "CVE-2016-6293",
        "CVE-2016-6294",
        "CVE-2016-7124",
        "CVE-2016-7125",
        "CVE-2016-7128",
        "CVE-2016-7411",
        "CVE-2016-7412",
        "CVE-2016-7414",
        "CVE-2016-7418",
        "CVE-2016-7480",
        "CVE-2016-9934",
        "CVE-2016-9935",
        "CVE-2017-11143",
        "CVE-2017-11144",
        "CVE-2017-11147",
        "CVE-2017-11628",
        "CVE-2017-12933",
        "CVE-2017-16642",
        "CVE-2017-7272",
        "CVE-2017-9224",
        "CVE-2017-9226",
        "CVE-2017-9227",
        "CVE-2017-9228",
        "CVE-2017-9229",
        "CVE-2018-10545",
        "CVE-2018-10547",
        "CVE-2018-14851",
        "CVE-2018-17082",
        "CVE-2018-5712",
        "CVE-2019-11040",
        "CVE-2019-11041",
        "CVE-2019-11042",
        "CVE-2019-11043"
      );
      script_bugtraq_id(
        61929,
        75974
      );
    
      script_name(english:"EulerOS 2.0 SP2 : php (EulerOS-SA-2019-2438)");
      script_summary(english:"Checks the rpm output for the updated packages.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote EulerOS host is missing multiple security updates.");
      script_set_attribute(attribute:"description", value:
    "According to the versions of the php packages installed, the EulerOS
    installation on the remote host is affected by the following
    vulnerabilities :
    
      - In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24
        and 7.3.x below 7.3.11 in certain configurations of FPM
        setup it is possible to cause FPM module to write past
        allocated buffers into the space reserved for FCGI
        protocol data, thus opening the possibility of remote
        code execution.(CVE-2019-11043)
    
      - The finish_nested_data function in
        ext/standard/var_unserializer.re in PHP before 5.6.31,
        7.0.x before 7.0.21, and 7.1.x before 7.1.7 is prone to
        a buffer over-read while unserializing untrusted data.
        Exploitation of this issue can have an unspecified
        impact on the integrity of PHP.(CVE-2017-12933)
    
      - ext/standard/var_unserializer.c in PHP before 5.6.25
        and 7.x before 7.0.10 mishandles certain invalid
        objects, which allows remote attackers to cause a
        denial of service or possibly have unspecified other
        impact via crafted serialized data that leads to a (1)
        __destruct call or (2) magic method
        call.(CVE-2016-7124)
    
      - The match function in pcre_exec.c in PCRE before 8.37
        mishandles the
        /(?:((abcd))|(((?:(?:(?:(?:abc|(?:abcdef))))b)abcdefghi
        )abc)|((*ACCEPT)))/ pattern and related patterns
        involving (*ACCEPT), which allows remote attackers to
        obtain sensitive information from process memory or
        cause a denial of service (partially initialized memory
        and application crash) via a crafted regular
        expression, as demonstrated by a JavaScript RegExp
        object encountered by Konqueror, aka
        ZDI-CAN-2547.(CVE-2015-8382)
    
      - An issue was discovered in PHP before 5.6.33, 7.0.x
        before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before
        7.2.1. There is Reflected XSS on the PHAR 404 error
        page via the URI of a request for a .phar
        file.(CVE-2018-5712)
    
      - exif_process_IFD_in_MAKERNOTE in ext/exif/exif.c in PHP
        before 5.6.37, 7.0.x before 7.0.31, 7.1.x before
        7.1.20, and 7.2.x before 7.2.8 allows remote attackers
        to cause a denial of service (out-of-bounds read and
        application crash) via a crafted JPEG
        file.(CVE-2018-14851)
    
      - The SplObjectStorage unserialize implementation in
        ext/spl/spl_observer.c in PHP before 7.0.12 does not
        verify that a key is an object, which allows remote
        attackers to execute arbitrary code or cause a denial
        of service (uninitialized memory access) via crafted
        serialized data.(CVE-2016-7480)
    
      - ext/standard/var_unserializer.re in PHP before 5.6.26
        mishandles object-deserialization failures, which
        allows remote attackers to cause a denial of service
        (memory corruption) or possibly have unspecified other
        impact via an unserialize call that references a
        partially constructed object.(CVE-2016-7411)
    
      - The odbc_bindcols function in ext/odbc/php_odbc.c in
        PHP before 5.6.12 mishandles driver behavior for
        SQL_WVARCHAR columns, which allows remote attackers to
        cause a denial of service (application crash) in
        opportunistic circumstances by leveraging use of the
        odbc_fetch_array function to access a certain type of
        Microsoft SQL Server table.(CVE-2015-8879)
    
      - In PHP before 5.6.32, 7.x before 7.0.25, and 7.1.x
        before 7.1.11, an error in the date extension's
        timelib_meridian handling of 'front of' and 'back of'
        directives could be used by attackers able to supply
        date strings to leak information from the interpreter,
        related to ext/date/lib/parse_date.c out-of-bounds
        reads affecting the php_parse_date function. NOTE: this
        is a different issue than
        CVE-2017-11145.(CVE-2017-16642)
    
      - The exif_process_IFD_in_JPEG function in
        ext/exif/exif.c in PHP before 5.5.35, 5.6.x before
        5.6.21, and 7.x before 7.0.6 does not validate IFD
        sizes, which allows remote attackers to cause a denial
        of service (out-of-bounds read) or possibly have
        unspecified other impact via crafted header
        data.(CVE-2016-4543)
    
      - The exif_process_IFD_TAG function in ext/exif/exif.c in
        PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before
        7.0.6 does not properly construct spprintf arguments,
        which allows remote attackers to cause a denial of
        service (out-of-bounds read) or possibly have
        unspecified other impact via crafted header
        data.(CVE-2016-4542)
    
      - The grapheme_strpos function in
        ext/intl/grapheme/grapheme_string.c in PHP before
        5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6
        allows remote attackers to cause a denial of service
        (out-of-bounds read) or possibly have unspecified other
        impact via a negative offset.(CVE-2016-4541)
    
      - The grapheme_stripos function in
        ext/intl/grapheme/grapheme_string.c in PHP before
        5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6
        allows remote attackers to cause a denial of service
        (out-of-bounds read) or possibly have unspecified other
        impact via a negative offset.(CVE-2016-4540)
    
      - The xml_parse_into_struct function in ext/xml/xml.c in
        PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before
        7.0.6 allows remote attackers to cause a denial of
        service (buffer under-read and segmentation fault) or
        possibly have unspecified other impact via crafted XML
        data in the second argument, leading to a parser level
        of zero.(CVE-2016-4539)
    
      - ** DISPUTED ** Integer overflow in the
        php_raw_url_encode function in ext/standard/url.c in
        PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before
        7.0.5 allows remote attackers to cause a denial of
        service (application crash) via a long string to the
        rawurlencode function. NOTE: the vendor says 'Not sure
        if this qualifies as security issue (probably
        not).'(CVE-2016-4070)
    
      - Use-after-free vulnerability in wddx.c in the WDDX
        extension in PHP before 5.5.33 and 5.6.x before 5.6.19
        allows remote attackers to cause a denial of service
        (memory corruption and application crash) or possibly
        have unspecified other impact by triggering a
        wddx_deserialize call on XML data containing a crafted
        var element.(CVE-2016-3141)
    
      - In PHP before 5.6.28 and 7.x before 7.0.13, incorrect
        handling of various URI components in the URL parser
        could be used by attackers to bypass hostname-specific
        URL checks, as demonstrated by
        evil.example.com:80#@good.example.com/ and
        evil.example.com:[email protected]/ inputs to the
        parse_url function (implemented in the php_url_parse_ex
        function in ext/standard/url.c).(CVE-2016-10397)
    
      - Multiple use-after-free vulnerabilities in SPL in PHP
        before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before
        5.6.12 allow remote attackers to execute arbitrary code
        via vectors involving (1) ArrayObject, (2)
        SplObjectStorage, and (3) SplDoublyLinkedList, which
        are mishandled during unserialization.(CVE-2015-6831)
    
      - An issue was discovered in Oniguruma 6.2.0, as used in
        Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP
        through 7.1.5. A heap out-of-bounds write occurs in
        bitset_set_range() during regular expression
        compilation due to an uninitialized variable from an
        incorrect state transition. An incorrect state
        transition in parse_char_class() could create an
        execution path that leaves a critical local variable
        uninitialized until it's used as an index, resulting in
        an out-of-bounds write memory
        corruption.(CVE-2017-9228)
    
      - An issue was discovered in Oniguruma 6.2.0, as used in
        Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP
        through 7.1.5. A stack out-of-bounds read occurs in
        mbc_enc_len() during regular expression searching.
        Invalid handling of reg->dmin in forward_search_range()
        could result in an invalid pointer dereference, as an
        out-of-bounds read from a stack buffer.(CVE-2017-9227)
    
      - An issue was discovered in Oniguruma 6.2.0, as used in
        Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP
        through 7.1.5. A heap out-of-bounds write or read
        occurs in next_state_val() during regular expression
        compilation. Octal numbers larger than 0xff are not
        handled correctly in fetch_token() and
        fetch_token_in_cc(). A malformed regular expression
        containing an octal number in the form of '\700' would
        produce an invalid code point value larger than 0xff in
        next_state_val(), resulting in an out-of-bounds write
        memory corruption.(CVE-2017-9226)
    
      - An issue was discovered in Oniguruma 6.2.0, as used in
        Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP
        through 7.1.5. A stack out-of-bounds read occurs in
        match_at() during regular expression searching. A
        logical error involving order of validation and access
        in match_at() could result in an out-of-bounds read
        from a stack buffer.(CVE-2017-9224)
    
      - The exif_process_IFD_in_MAKERNOTE function in
        ext/exif/exif.c in PHP before 5.5.38, 5.6.x before
        5.6.24, and 7.x before 7.0.9 allows remote attackers to
        cause a denial of service (out-of-bounds array access
        and memory corruption), obtain sensitive information
        from process memory, or possibly have unspecified other
        impact via a crafted JPEG image.(CVE-2016-6291)
    
      - The php_url_parse_ex function in ext/standard/url.c in
        PHP before 5.5.38 allows remote attackers to cause a
        denial of service (buffer over-read) or possibly have
        unspecified other impact via vectors involving the
        smart_str data type.(CVE-2016-6288)
    
      - Integer overflow in the php_html_entities function in
        ext/standard/html.c in PHP before 5.5.36 and 5.6.x
        before 5.6.22 allows remote attackers to cause a denial
        of service or possibly have unspecified other impact by
        triggering a large output string from the
        htmlspecialchars function.(CVE-2016-5094)
    
      - The get_icu_value_internal function in
        ext/intl/locale/locale_methods.c in PHP before 5.5.36,
        5.6.x before 5.6.22, and 7.x before 7.0.7 does not
        ensure the presence of a '\0' character, which allows
        remote attackers to cause a denial of service
        (out-of-bounds read) or possibly have unspecified other
        impact via a crafted locale_get_primary_language
        call.(CVE-2016-5093)
    
      - In PHP before 5.6.31, an invalid free in the WDDX
        deserialization of boolean parameters could be used by
        attackers able to inject XML for deserialization to
        crash the PHP interpreter, related to an invalid free
        for an empty boolean element in
        ext/wddx/wddx.c.(CVE-2017-11143)
    
      - The php_wddx_push_element function in ext/wddx/wddx.c
        in PHP before 5.6.29 and 7.x before 7.0.14 allows
        remote attackers to cause a denial of service
        (out-of-bounds read and memory corruption) or possibly
        have unspecified other impact via an empty boolean
        element in a wddxPacket XML document.(CVE-2016-9935)
    
      - ext/wddx/wddx.c in PHP before 5.6.28 and 7.x before
        7.0.13 allows remote attackers to cause a denial of
        service (NULL pointer dereference) via crafted
        serialized data in a wddxPacket XML document, as
        demonstrated by a PDORow string.(CVE-2016-9934)
    
      - The ZIP signature-verification feature in PHP before
        5.6.26 and 7.x before 7.0.11 does not ensure that the
        uncompressed_filesize field is large enough, which
        allows remote attackers to cause a denial of service
        (out-of-bounds memory access) or possibly have
        unspecified other impact via a crafted PHAR archive,
        related to ext/phar/util.c and
        ext/phar/zip.c.(CVE-2016-7414)
    
      - ext/mysqlnd/mysqlnd_wireprotocol.c in PHP before 5.6.26
        and 7.x before 7.0.11 does not verify that a BIT field
        has the UNSIGNED_FLAG flag, which allows remote MySQL
        servers to cause a denial of service (heap-based buffer
        overflow) or possibly have unspecified other impact via
        crafted field metadata.(CVE-2016-7412)
    
      - An issue was discovered in Oniguruma 6.2.0, as used in
        Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP
        through 7.1.5. A SIGSEGV occurs in
        left_adjust_char_head() during regular expression
        compilation. Invalid handling of reg->dmax in
        forward_search_range() could result in an invalid
        pointer dereference, normally as an immediate
        denial-of-service condition.(CVE-2017-9229)
    
      - The openssl_random_pseudo_bytes function in
        ext/openssl/openssl.c in PHP before 5.4.44, 5.5.x
        before 5.5.28, and 5.6.x before 5.6.12 incorrectly
        relies on the deprecated RAND_pseudo_bytes function,
        which makes it easier for remote attackers to defeat
        cryptographic protection mechanisms via unspecified
        vectors.(CVE-2015-8867)
    
      - The sapi_header_op function in main/SAPI.c in PHP
        before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before
        5.6.6 supports deprecated line folding without
        considering browser compatibility, which allows remote
        attackers to conduct cross-site scripting (XSS) attacks
        against Internet Explorer by leveraging (1) %0A%20 or
        (2) %0D%0A%20 mishandling in the header
        function.(CVE-2015-8935)
    
      - An issue was discovered in PHP before 5.6.35, 7.0.x
        before 7.0.29, 7.1.x before 7.1.16, and 7.2.x before
        7.2.4. Dumpable FPM child processes allow bypassing
        opcache access controls because fpm_unix.c makes a
        PR_SET_DUMPABLE prctl call, allowing one user (in a
        multiuser environment) to obtain sensitive information
        from the process memory of a second user's PHP
        applications by running gcore on the PID of the PHP-FPM
        worker process.(CVE-2018-10545)
    
      - An issue was discovered in ext/phar/phar_object.c in
        PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before
        7.1.17, and 7.2.x before 7.2.5. There is Reflected XSS
        on the PHAR 403 and 404 error pages via request data of
        a request for a .phar file. NOTE: this vulnerability
        exists because of an incomplete fix for
        CVE-2018-5712.(CVE-2018-10547)
    
      - The Apache2 component in PHP before 5.6.38, 7.0.x
        before 7.0.32, 7.1.x before 7.1.22, and 7.2.x before
        7.2.10 allows XSS via the body of a 'Transfer-Encoding:
        chunked' request, because the bucket brigade is
        mishandled in the php_handler function in
        sapi/apache2handler/sapi_apache2.c.(CVE-2018-17082)
    
      - PHP through 7.1.11 enables potential SSRF in
        applications that accept an fsockopen or pfsockopen
        hostname argument with an expectation that the port
        number is constrained. Because a :port syntax is
        recognized, fsockopen will use the port number that is
        specified in the hostname argument, instead of the port
        number in the second argument of the
        function.(CVE-2017-7272 )
    
      - In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x
        before 7.1.7, a stack-based buffer overflow in the
        zend_ini_do_op() function in Zend/zend_ini_parser.c
        could cause a denial of service or potentially allow
        executing code. NOTE: this is only relevant for PHP
        applications that accept untrusted input (instead of
        the system's php.ini file) for the parse_ini_string or
        parse_ini_file function, e.g., a web application for
        syntax validation of php.ini
        directives.(CVE-2017-11628)
    
      - In PHP before 5.6.30 and 7.x before 7.0.15, the PHAR
        archive handler could be used by attackers supplying
        malicious archive files to crash the PHP interpreter or
        potentially disclose information due to a buffer
        over-read in the phar_parse_pharfile function in
        ext/phar/phar.c.(CVE-2017-11147)
    
      - In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x
        before 7.1.7, the openssl extension PEM sealing code
        did not check the return value of the OpenSSL sealing
        function, which could lead to a crash of the PHP
        interpreter, related to an interpretation conflict for
        a negative number in ext/openssl/openssl.c, and an
        OpenSSL documentation omission.(CVE-2017-11144)
    
      - The locale_accept_from_http function in
        ext/intl/locale/locale_methods.c in PHP before 5.5.38,
        5.6.x before 5.6.24, and 7.x before 7.0.9 does not
        properly restrict calls to the ICU
        uloc_acceptLanguageFromHTTP function, which allows
        remote attackers to cause a denial of service
        (out-of-bounds read) or possibly have unspecified other
        impact via a call with a long argument.(CVE-2016-6294)
    
      - Session fixation vulnerability in the Sessions
        subsystem in PHP before 5.5.2 allows remote attackers
        to hijack web sessions by specifying a session
        ID.(CVE-2011-4718)
    
      - Off-by-one error in the phar_parse_zipfile function in
        ext/phar/zip.c in PHP before 5.5.30 and 5.6.x before
        5.6.14 allows remote attackers to cause a denial of
        service (uninitialized pointer dereference and
        application crash) by including the / filename in a
        .zip PHAR archive.(CVE-2015-7804)
    
      - The php_wddx_push_element function in ext/wddx/wddx.c
        in PHP before 5.6.26 and 7.x before 7.0.11 allows
        remote attackers to cause a denial of service (invalid
        pointer access and out-of-bounds read) or possibly have
        unspecified other impact via an incorrect boolean
        element in a wddxPacket XML document, leading to
        mishandling in a wddx_deserialize call.(CVE-2016-7418)
    
      - The exif_process_user_comment function in
        ext/exif/exif.c in PHP before 5.5.38, 5.6.x before
        5.6.24, and 7.x before 7.0.9 allows remote attackers to
        cause a denial of service (NULL pointer dereference and
        application crash) via a crafted JPEG
        image.(CVE-2016-6292)
    
      - The make_http_soap_request function in
        ext/soap/php_http.c in PHP before 5.4.44, 5.5.x before
        5.5.28, 5.6.x before 5.6.12, and 7.x before 7.0.4
        allows remote attackers to obtain sensitive information
        from process memory or cause a denial of service (type
        confusion and application crash) via crafted serialized
        _cookies data, related to the SoapClient::__call method
        in ext/soap/soap.c.(CVE-2016-3185)
    
      - Directory traversal vulnerability in the
        ZipArchive::extractTo function in ext/zip/php_zip.c in
        PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x
        before 5.6.13 and ext/zip/ext_zip.cpp in HHVM before
        3.12.1 allows remote attackers to create arbitrary
        empty directories via a crafted ZIP
        archive.(CVE-2014-9767)
    
      - The phar_convert_to_other function in
        ext/phar/phar_object.c in PHP before 5.4.43, 5.5.x
        before 5.5.27, and 5.6.x before 5.6.11 does not
        validate a file pointer before a close operation, which
        allows remote attackers to cause a denial of service
        (segmentation fault) or possibly have unspecified other
        impact via a crafted TAR archive that is mishandled in
        a Phar::convertToData call.(CVE-2015-5589)
    
      - Directory traversal vulnerability in the PharData class
        in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x
        before 5.6.12 allows remote attackers to write to
        arbitrary files via a .. (dot dot) in a ZIP archive
        entry that is mishandled during an extractTo
        call.(CVE-2015-6833)
    
      - The phar_get_entry_data function in ext/phar/util.c in
        PHP before 5.5.30 and 5.6.x before 5.6.14 allows remote
        attackers to cause a denial of service (NULL pointer
        dereference and application crash) via a .phar file
        with a crafted TAR archive entry in which the Link
        indicator references a file that does not
        exist.(CVE-2015-7803)
    
      - Stack consumption vulnerability in GD in PHP before
        5.6.12 allows remote attackers to cause a denial of
        service via a crafted imagefilltoborder
        call.(CVE-2015-8874)
    
      - Stack-based buffer overflow in ext/phar/tar.c in PHP
        before 5.5.32, 5.6.x before 5.6.18, and 7.x before
        7.0.3 allows remote attackers to cause a denial of
        service (application crash) or possibly have
        unspecified other impact via a crafted TAR
        archive.(CVE-2016-2554)
    
      - The phar_parse_zipfile function in zip.c in the PHAR
        extension in PHP before 5.5.33 and 5.6.x before 5.6.19
        allows remote attackers to obtain sensitive information
        from process memory or cause a denial of service
        (out-of-bounds read and application crash) by placing a
        PK\x05\x06 signature at an invalid
        location.(CVE-2016-3142)
    
      - ext/session/session.c in PHP before 5.6.25 and 7.x
        before 7.0.10 skips invalid session names in a way that
        triggers incorrect parsing, which allows remote
        attackers to inject arbitrary-type session data by
        leveraging control of a session name, as demonstrated
        by object injection.(CVE-2016-7125)
    
      - The exif_process_IFD_in_TIFF function in
        ext/exif/exif.c in PHP before 5.6.25 and 7.x before
        7.0.10 mishandles the case of a thumbnail offset that
        exceeds the file size, which allows remote attackers to
        obtain sensitive information from process memory via a
        crafted TIFF image.(CVE-2016-7128)
    
      - The get_icu_disp_value_src_php function in
        ext/intl/locale/locale_methods.c in PHP before 5.3.29,
        5.4.x before 5.4.30, and 5.5.x before 5.5.14 does not
        properly restrict calls to the ICU uresbund.cpp
        component, which allows remote attackers to cause a
        denial of service (buffer overflow) or possibly have
        unspecified other impact via a locale_get_display_name
        call with a long first argument.(CVE-2014-9912)
    
      - Use-after-free vulnerability in the SPL unserialize
        implementation in ext/spl/spl_array.c in PHP before
        5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12
        allows remote attackers to execute arbitrary code via
        crafted serialized data that triggers misuse of an
        array field.(CVE-2015-6832)
    
      - The make_http_soap_request function in
        ext/soap/php_http.c in PHP before 5.4.44, 5.5.x before
        5.5.28, and 5.6.x before 5.6.12 does not properly
        retrieve keys, which allows remote attackers to cause a
        denial of service (NULL pointer dereference, type
        confusion, and application crash) or possibly execute
        arbitrary code via crafted serialized data representing
        a numerically indexed _cookies array, related to the
        SoapClient::__call method in
        ext/soap/soap.c.(CVE-2015-8835)
    
      - The uloc_acceptLanguageFromHTTP function in
        common/uloc.cpp in International Components for Unicode
        (ICU) through 57.1 for C/C++ does not ensure that there
        is a '\0' character at the end of a certain temporary
        array, which allows remote attackers to cause a denial
        of service (out-of-bounds read) or possibly have
        unspecified other impact via a call with a long
        httpAcceptLanguage argument.(CVE-2016-6293)
    
      - When PHP EXIF extension is parsing EXIF information
        from an image, e.g. via exif_read_data() function, in
        PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and
        7.3.x below 7.3.6 it is possible to supply it with data
        what will cause it to read past the allocated buffer.
        This may lead to information disclosure or
        crash.(CVE-2019-11040)
    
      - When PHP EXIF extension is parsing EXIF information
        from an image, e.g. via exif_read_data() function, in
        PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and
        7.3.x below 7.3.8 it is possible to supply it with data
        what will cause it to read past the allocated buffer.
        This may lead to information disclosure or
        crash.(CVE-2019-11041)
    
      - When PHP EXIF extension is parsing EXIF information
        from an image, e.g. via exif_read_data() function, in
        PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and
        7.3.x below 7.3.8 it is possible to supply it with data
        what will cause it to read past the allocated buffer.
        This may lead to information disclosure or
        crash.(CVE-2019-11042)
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the EulerOS security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues.");
      # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2019-2438
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?72902c09");
      script_set_attribute(attribute:"solution", value:
    "Update the affected php packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'PHP-FPM Underflow RCE');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2019/12/04");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/12/04");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:php");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:php-cli");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:php-common");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:php-gd");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:php-ldap");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:php-mysql");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:php-odbc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:php-pdo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:php-pgsql");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:php-process");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:php-recode");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:php-soap");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:php-xml");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:php-xmlrpc");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Huawei Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp");
      script_exclude_keys("Host/EulerOS/uvp_version");
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    
    release = get_kb_item("Host/EulerOS/release");
    if (isnull(release) || release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
    if (release !~ "^EulerOS release 2\.0(\D|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0");
    
    sp = get_kb_item("Host/EulerOS/sp");
    if (isnull(sp) || sp !~ "^(2)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP2");
    
    uvp = get_kb_item("Host/EulerOS/uvp_version");
    if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP2", "EulerOS UVP " + uvp);
    
    if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_ARCH_NOT, "i686 / x86_64", cpu);
    
    flag = 0;
    
    pkgs = ["php-5.4.16-42.h63",
            "php-cli-5.4.16-42.h63",
            "php-common-5.4.16-42.h63",
            "php-gd-5.4.16-42.h63",
            "php-ldap-5.4.16-42.h63",
            "php-mysql-5.4.16-42.h63",
            "php-odbc-5.4.16-42.h63",
            "php-pdo-5.4.16-42.h63",
            "php-pgsql-5.4.16-42.h63",
            "php-process-5.4.16-42.h63",
            "php-recode-5.4.16-42.h63",
            "php-soap-5.4.16-42.h63",
            "php-xml-5.4.16-42.h63",
            "php-xmlrpc-5.4.16-42.h63"];
    
    foreach (pkg in pkgs)
      if (rpm_check(release:"EulerOS-2.0", sp:"2", reference:pkg)) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "php");
    }
    
  • NASL familyCGI abuses
    NASL idPHP_5_5_2.NASL
    descriptionAccording to its banner, the version of PHP 5.5.x installed on the remote host is a version prior to 5.5.3. It is, therefore, potentially affected by the following vulnerabilities : - An error exists related to the
    last seen2020-06-01
    modified2020-06-02
    plugin id69402
    published2013-08-21
    reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/69402
    titlePHP 5.5.x < 5.5.3 Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(69402);
      script_version("1.12");
      script_cvs_date("Date: 2019/03/27 13:17:50");
    
      script_cve_id("CVE-2011-4718", "CVE-2013-4248");
      script_bugtraq_id(61776, 61929);
    
      script_name(english:"PHP 5.5.x < 5.5.3 Multiple Vulnerabilities");
      script_summary(english:"Checks version of PHP");
    
      script_set_attribute(
        attribute:"synopsis",
        value:
    "The remote web server uses a version of PHP that is potentially
    affected by multiple vulnerabilities."
      );
      script_set_attribute(
        attribute:"description",
        value:
    "According to its banner, the version of PHP 5.5.x installed on the
    remote host is a version prior to 5.5.3.  It is, therefore,
    potentially affected by the following vulnerabilities : 
    
      - An error exists related to the 'Sessions' subsystem
        that can allow an attacker to hijack the session of
        another user. (CVE-2011-4718 / Bug #60491)
    
      - An error exists related to certificate validation, the
        'subjectAltName' field and certificates containing NULL
        bytes. This error can allow spoofing attacks.
        (CVE-2013-4248)
    
    Note that this plugin does not attempt to exploit these
    vulnerabilities, but instead relies only on PHP's self-reported
    version number."
      );
      script_set_attribute(attribute:"see_also", value:"https://bugs.php.net/bug.php?id=60491");
      script_set_attribute(attribute:"see_also", value:"http://www.php.net/ChangeLog-5.php#5.5.3");
      script_set_attribute(attribute:"see_also", value:"http://php.net/releases/5_5_3.php");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to PHP version 5.5.3 or later.
    
    Note the 5.5.2 release contains an uninitialized memory read bug and
    a compile error that prevent proper operation.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2011-4718");
      script_set_attribute(attribute:"exploitability_ease", value:"No exploit is required");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2011/12/02");
      script_set_attribute(attribute:"patch_publication_date", value:"2013/08/15");
      script_set_attribute(attribute:"plugin_publication_date", value:"2013/08/21");
    
      script_set_attribute(attribute:"plugin_type", value:"remote");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:php:php");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"CGI abuses");
    
      script_copyright(english:"This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("php_version.nasl");
      script_require_ports("Services/www", 80);
      script_require_keys("www/PHP");
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("http.inc");
    include("webapp_func.inc");
    
    port = get_http_port(default:80, php:TRUE);
    
    php = get_php_from_kb(
      port : port,
      exit_on_fail : TRUE
    );
    
    version = php["ver"];
    source = php["src"];
    
    backported = get_kb_item('www/php/'+port+'/'+version+'/backported');
    
    if (report_paranoia < 2 && backported)
      audit(AUDIT_BACKPORT_SERVICE, port, "PHP "+version+" install");
    
    # Check that it is the correct version of PHP
    if (version =~ "^5(\.5)?$") exit(1, "The banner from the PHP install associated with port "+port+" - "+version+" - is not granular enough to make a determination.");
    if (version !~ "^5\.5\.") audit(AUDIT_NOT_DETECT, "PHP version 5.5.x", port);
    
    if (version =~ "^5\.5\.[012]($|[^0-9])")
    {
      if (report_verbosity > 0)
      {
        report =
          '\n  Version source    : '+source +
          '\n  Installed version : '+version+
          '\n  Fixed version     : 5.5.3\n';
        security_warning(port:port, extra:report);
      }
      else security_warning(port);
      exit(0);
    }
    else audit(AUDIT_LISTEN_NOT_VULN, "PHP", port, version);