Vulnerabilities > CVE-2013-4636 - Improper Input Validation vulnerability in PHP

#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(66843);
  script_version("1.15");
  script_cvs_date("Date: 2019/11/27");

  script_cve_id("CVE-2013-2110", "CVE-2013-4635", "CVE-2013-4636");
  script_bugtraq_id(60411, 60728, 60731);

  script_name(english:"PHP 5.4.x < 5.4.16 Multiple Vulnerabilities");
  script_summary(english:"Checks version of PHP");

  script_set_attribute(attribute:"synopsis", value:
"The remote web server uses a version of PHP that is potentially
affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"According to its banner, the version of PHP 5.4.x installed on the
remote host is prior to 5.4.16.  It is, therefore, potentially 
affected by the following vulnerabilities:

  - An error exists in the mimetype detection of 'mp3' files
    that could lead to a denial of service. (Bug #64830)

  - An error exists in the function 'php_quot_print_encode'
    in the file 'ext/standard/quot_print.c' that could allow
    a heap-based buffer overflow when attempting to parse
    certain strings. (Bug #64879)

  - An integer overflow error exists related to the value
    of 'JEWISH_SDN_MAX' in the file 'ext/calendar/jewish.c'
    that could allow denial of service attacks. (Bug #64895)

Note that this plugin does not attempt to exploit these 
vulnerabilities, but instead relies only on PHP's self-reported
version number.");
  # https://github.com/php/php-src/commit/93e0d78ec655f59ebfa82b2c6f8486c43651c1d0
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?60cbc5f0");
  # http://git.php.net/?p=php-src.git;a=blobdiff;f=ext/calendar/jewish.c;h=fcc0e5c0b878ebdd41dfeaecf148b755cd5e6f2d;hp=1e7a06c8a6dd0d6bf3b24f912a7fd40b53cbef69;hb=c50cef1dc54ffd1d0fb71d1afb8b2c3cb3c5b6ef;hpb=d4ad8898247da4eca2221e564eb8c025bc783a0b
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8456482e");
  script_set_attribute(attribute:"see_also", value:"http://www.php.net/ChangeLog-5.php#5.4.16");
  script_set_attribute(attribute:"solution", value:
"Apply the vendor patch or upgrade to PHP version 5.4.16 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2013-4635");

  script_set_attribute(attribute:"exploitability_ease", value:"No exploit is required");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2013/05/22");
  script_set_attribute(attribute:"patch_publication_date", value:"2013/06/06");
  script_set_attribute(attribute:"plugin_publication_date", value:"2013/06/07");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:php:php");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("php_version.nasl");
  script_require_keys("www/PHP");
  script_require_ports("Services/www", 80);

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("http.inc");
include("webapp_func.inc");

port = get_http_port(default:80, php:TRUE);

php = get_php_from_kb(
  port : port,
  exit_on_fail : TRUE
);

version = php["ver"];
source = php["src"];

backported = get_kb_item('www/php/'+port+'/'+version+'/backported');

if (report_paranoia < 2 && backported)
  audit(AUDIT_BACKPORT_SERVICE, port, "PHP "+version+" install");

# Check that it is the correct version of PHP
if (version =~ "^5(\.4)?$") exit(1, "The banner from the PHP install associated with port "+port+" - "+version+" - is not granular enough to make a determination.");
if (version !~ "^5\.4\.") audit(AUDIT_NOT_DETECT, "PHP version 5.4.x", port);

if (version =~ "^5\.4\.([0-9]|1[0-5])($|[^0-9])")
{
  if (report_verbosity > 0)
  {
    report =
      '\n  Version source    : '+source +
      '\n  Installed version : '+version+
      '\n  Fixed version     : 5.4.16\n';
    security_warning(port:port, extra:report);
  }
  else security_warning(port);
  exit(0);
}
else audit(AUDIT_LISTEN_NOT_VULN, "PHP", port, version);

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from the Oracle Third Party software advisories.
#
include("compat.inc");

if (description)
{
  script_id(80736);
  script_version("1.4");
  script_cvs_date("Date: 2018/11/15 20:50:25");

  script_cve_id("CVE-2011-4718", "CVE-2012-2688", "CVE-2012-3365", "CVE-2013-1635", "CVE-2013-1643", "CVE-2013-2110", "CVE-2013-4113", "CVE-2013-4248", "CVE-2013-4635", "CVE-2013-4636");

  script_name(english:"Oracle Solaris Third-Party Patch Update : php (cve_2013_4113_buffer_errors)");
  script_summary(english:"Check for the 'entire' version.");

  script_set_attribute(
    attribute:"synopsis", 
    value:
"The remote Solaris system is missing a security patch for third-party
software."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"The remote Solaris system is missing necessary patches to address
security updates :

  - Session fixation vulnerability in the Sessions subsystem
    in PHP before 5.5.2 allows remote attackers to hijack
    web sessions by specifying a session ID. (CVE-2011-4718)

  - Unspecified vulnerability in the _php_stream_scandir
    function in the stream implementation in PHP before
    5.3.15 and 5.4.x before 5.4.5 has unknown impact and
    remote attack vectors, related to an 'overflow.'
    (CVE-2012-2688)

  - The SQLite functionality in PHP before 5.3.15 allows
    remote attackers to bypass the open_basedir protection
    mechanism via unspecified vectors. (CVE-2012-3365)

  - ext/soap/soap.c in PHP before 5.3.22 and 5.4.x before
    5.4.13 does not validate the relationship between the
    soap.wsdl_cache_dir directive and the open_basedir
    directive, which allows remote attackers to bypass
    intended access restrictions by triggering the creation
    of cached SOAP WSDL files in an arbitrary directory.
    (CVE-2013-1635)

  - The SOAP parser in PHP before 5.3.23 and 5.4.x before
    5.4.13 allows remote attackers to read arbitrary files
    via a SOAP WSDL file containing an XML external entity
    declaration in conjunction with an entity reference,
    related to an XML External Entity (XXE) issue in the
    soap_xmlParseFile and soap_xmlParseMemory functions.
    NOTE: this vulnerability exists because of an incorrect
    fix for CVE-2013-1824. (CVE-2013-1643)

  - Heap-based buffer overflow in the php_quot_print_encode
    function in ext/ standard/quot_print.c in PHP before
    5.3.26 and 5.4.x before 5.4.16 allows remote attackers
    to cause a denial of service (application crash) or
    possibly have unspecified other impact via a crafted
    argument to the quoted_printable_encode function.
    (CVE-2013-2110)

  - ext/xml/xml.c in PHP before 5.3.27 does not properly
    consider parsing depth, which allows remote attackers to
    cause a denial of service (heap memory corruption) or
    possibly have unspecified other impact via a crafted
    document that is processed by the xml_parse_into_struct
    function. (CVE-2013-4113)

  - The openssl_x509_parse function in openssl.c in the
    OpenSSL module in PHP before 5.4.18 and 5.5.x before
    5.5.2 does not properly handle a '\0' character in a
    domain name in the Subject Alternative Name field of an
    X.509 certificate, which allows man-in-the-middle
    attackers to spoof arbitrary SSL servers via a crafted
    certificate issued by a legitimate Certification
    Authority, a related issue to CVE-2009-2408.
    (CVE-2013-4248)

  - Integer overflow in the SdnToJewish function in jewish.c
    in the Calendar component in PHP before 5.3.26 and 5.4.x
    before 5.4.16 allows context-dependent attackers to
    cause a denial of service (application hang) via a large
    argument to the jdtojewish function. (CVE-2013-4635)

  - The mget function in libmagic/softmagic.c in the
    Fileinfo component in PHP 5.4.x before 5.4.16 allows
    remote attackers to cause a denial of service (invalid
    pointer dereference and application crash) via an MP3
    file that triggers incorrect MIME type detection during
    access to an finfo object. (CVE-2013-4636)"
  );
  # https://www.oracle.com/technetwork/topics/security/thirdparty-patch-map-1482893.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?4a913f44"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://blogs.oracle.com/sunsecurity/cve-2013-4113-buffer-errors-vulnerability-in-php"
  );
  # https://blogs.oracle.com/sunsecurity/multiple-vulnerabilities-in-php
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?b4abfefa"
  );
  # https://blogs.oracle.com/sunsecurity/multiple-vulnerabilities-in-php1
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?b4abfefa"
  );
  # https://blogs.oracle.com/sunsecurity/multiple-vulnerabilities-in-php2
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?b4abfefa"
  );
  script_set_attribute(attribute:"solution", value:"Upgrade to Solaris 11.1.17.5.0.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:solaris:11.1");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:solaris:php");

  script_set_attribute(attribute:"patch_publication_date", value:"2014/04/01");
  script_set_attribute(attribute:"plugin_publication_date", value:"2015/01/19");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2015-2018 Tenable Network Security, Inc.");
  script_family(english:"Solaris Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Solaris11/release", "Host/Solaris11/pkg-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("solaris.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/Solaris11/release");
if (isnull(release)) audit(AUDIT_OS_NOT, "Solaris11");
pkg_list = solaris_pkg_list_leaves();
if (isnull (pkg_list)) audit(AUDIT_PACKAGE_LIST_MISSING, "Solaris pkg-list packages");

if (empty_or_null(egrep(string:pkg_list, pattern:"^php$"))) audit(AUDIT_PACKAGE_NOT_INSTALLED, "php");

flag = 0;

if (solaris_check_release(release:"0.5.11-0.175.1.17.0.5.0", sru:"SRU 11.1.17.5.0") > 0) flag++;

if (flag)
{
  error_extra = 'Affected package : php\n' + solaris_get_report2();
  error_extra = ereg_replace(pattern:"version", replace:"OS version", string:error_extra);
  if (report_verbosity > 0) security_hole(port:0, extra:error_extra);
  else security_hole(0);
  exit(0);
}
else audit(AUDIT_PACKAGE_NOT_AFFECTED, "php");

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Gentoo Linux Security Advisory GLSA 201408-11.
#
# The advisory text is Copyright (C) 2001-2017 Gentoo Foundation, Inc.
# and licensed under the Creative Commons - Attribution / Share Alike 
# license. See http://creativecommons.org/licenses/by-sa/3.0/
#

include("compat.inc");

if (description)
{
  script_id(77455);
  script_version("1.13");
  script_cvs_date("Date: 2018/07/12 19:01:15");

  script_cve_id("CVE-2011-4718", "CVE-2013-1635", "CVE-2013-1643", "CVE-2013-1824", "CVE-2013-2110", "CVE-2013-3735", "CVE-2013-4113", "CVE-2013-4248", "CVE-2013-4635", "CVE-2013-4636", "CVE-2013-6420", "CVE-2013-6712", "CVE-2013-7226", "CVE-2013-7327", "CVE-2013-7345", "CVE-2014-0185", "CVE-2014-0237", "CVE-2014-0238", "CVE-2014-1943", "CVE-2014-2270", "CVE-2014-2497", "CVE-2014-3597", "CVE-2014-3981", "CVE-2014-4049", "CVE-2014-4670", "CVE-2014-5120");
  script_bugtraq_id(58224, 58766, 60411, 60728, 60731, 61128, 61776, 61929, 62373, 64018, 64225, 65533, 65596, 65668, 66002, 66233, 66406, 67118, 67759, 67765, 67837, 68007, 68513, 69322, 69375);
  script_xref(name:"GLSA", value:"201408-11");

  script_name(english:"GLSA-201408-11 : PHP: Multiple vulnerabilities");
  script_summary(english:"Checks for updated package(s) in /var/db/pkg");

  script_set_attribute(
    attribute:"synopsis", 
    value:
"The remote Gentoo host is missing one or more security-related
patches."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"The remote host is affected by the vulnerability described in GLSA-201408-11
(PHP: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in PHP. Please review the
      CVE identifiers referenced below for details.
  
Impact :

    A context-dependent attacker can cause arbitrary code execution, create
      a Denial of Service condition, read or write arbitrary files, impersonate
      other servers, hijack a web session, or have other unspecified impact.
      Additionally, a local attacker could gain escalated privileges.
  
Workaround :

    There is no known workaround at this time."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security.gentoo.org/glsa/201408-11"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"All PHP 5.5 users should upgrade to the latest version:
      # emerge --sync
      # emerge --ask --oneshot --verbose '>=dev-lang/php-5.5.16'
    All PHP 5.4 users should upgrade to the latest version:
      # emerge --sync
      # emerge --ask --oneshot --verbose '>=dev-lang/php-5.4.32'
    All PHP 5.3 users should upgrade to the latest version. This release
      marks the end of life of the PHP 5.3 series. Future releases of this
      series are not planned. All PHP 5.3 users are encouraged to upgrade to
      the current stable version of PHP 5.5 or previous stable version of PHP
      5.4, which are supported till at least 2016 and 2015 respectively.
      # emerge --sync
      # emerge --ask --oneshot --verbose '>=dev-lang/php-5.3.29'"
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:php");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux");

  script_set_attribute(attribute:"patch_publication_date", value:"2014/08/29");
  script_set_attribute(attribute:"plugin_publication_date", value:"2014/08/30");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2014-2018 Tenable Network Security, Inc.");
  script_family(english:"Gentoo Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("qpkg.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo");
if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;

if (qpkg_check(package:"dev-lang/php", unaffected:make_list("ge 5.5.16", "rge 5.4.32", "rge 5.3.29", "rge 5.4.34", "rge 5.4.35", "rge 5.4.36", "rge 5.4.37", "rge 5.4.38", "rge 5.4.39", "rge 5.4.40", "rge 5.4.41", "rge 5.4.42", "rge 5.4.43", "rge 5.4.44", "rge 5.4.45", "rge 5.4.46"), vulnerable:make_list("lt 5.5.16"))) flag++;

if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());
  else security_hole(0);
  exit(0);
}
else
{
  tested = qpkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "PHP");
}