Executive Summary

Summary
Title New php4 packages fix several vulnerabilities
Informations
Name DSA-1282 First vendor Publication 2006-04-26
Vendor Debian Last vendor Modification 2006-04-26
Severity (Vendor) N/A Revision 1

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:N/I:C/A:N)
Cvss Base Score 7.8 Attack Range Network
Cvss Impact Score 6.9 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Several remote vulnerabilities have been discovered in PHP, a server-side, HTML-embedded scripting language, which may lead to the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems:

CVE-2007-1286 Stefan Esser discovered an overflow in the object reference handling code of the unserialize() function, which allows the execution of arbitrary code if malformed input is passed from an application.

CVE-2007-1380 Stefan Esser discovered that the session handler performs insufficient validation of variable name length values, which allows information disclosure through a heap information leak.

CVE-2007-1521 Stefan Esser discovered a double free vulnerability in the session_regenerate_id() function, which allows the execution of arbitrary code.

CVE-2007-1711 Stefan Esser discovered a double free vulnerability in the session management code, which allows the execution of arbitrary code.

CVE-2007-1718 Stefan Esser discovered that the mail() function performs insufficient validation of folded mail headers, which allows mail header injection.

CVE-2007-1777 Stefan Esser discovered that the extension to handle ZIP archives performs insufficient length checks, which allows the execution of arbitrary code.

For the oldstable distribution (sarge) these problems have been fixed in version 4.3.10-20.

For the stable distribution (etch) these problems have been fixed in version 4.4.4-8+etch2.

For the unstable distribution (sid) these problems have been fixed in version 4.4.6-1. php4 will be removed from sid; thus you are strongly advised to migrate to php5 if you prefer to follow the unstable distribution.

We recommend that you upgrade your PHP packages. Packages for the arm, m68k and mipsen architectures are not yet available. They will be provided later.

Original Source

Url : http://www.debian.org/security/2006/dsa-1282

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:10406
 
Oval ID: oval:org.mitre.oval:def:10406
Title: Double free vulnerability in the unserializer in PHP 4.4.5 and 4.4.6 allows context-dependent attackers to execute arbitrary code by overwriting variables pointing to (1) the GLOBALS array or (2) the session data in _SESSION. NOTE: this issue was introduced when attempting to patch CVE-2007-1701 (MOPB-31-2007).
Description: Double free vulnerability in the unserializer in PHP 4.4.5 and 4.4.6 allows context-dependent attackers to execute arbitrary code by overwriting variables pointing to (1) the GLOBALS array or (2) the session data in _SESSION. NOTE: this issue was introduced when attempting to patch CVE-2007-1701 (MOPB-31-2007).
Family: unix Class: vulnerability
Reference(s): CVE-2007-1711
 Version: 5
Platform(s): Red Hat Enterprise Linux 3
CentOS Linux 3
Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
 Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:10792
 
Oval ID: oval:org.mitre.oval:def:10792
Title: The php_binary serialization handler in the session extension in PHP before 4.4.5, and 5.x before 5.2.1, allows context-dependent attackers to obtain sensitive information (memory contents) via a serialized variable entry with a large length value, which triggers a buffer over-read.
Description: The php_binary serialization handler in the session extension in PHP before 4.4.5, and 5.x before 5.2.1, allows context-dependent attackers to obtain sensitive information (memory contents) via a serialized variable entry with a large length value, which triggers a buffer over-read.
Family: unix Class: vulnerability
Reference(s): CVE-2007-1380
 Version: 5
Platform(s): Red Hat Enterprise Linux 3
CentOS Linux 3
Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
 Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:10951
 
Oval ID: oval:org.mitre.oval:def:10951
Title: CRLF injection vulnerability in the mail function in PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 allows remote attackers to inject arbitrary e-mail headers and possibly conduct spam attacks via a control character immediately following folding of the (1) Subject or (2) To parameter, as demonstrated by a parameter containing a "\r\n\t\n" sequence, related to an increment bug in the SKIP_LONG_HEADER_SEP macro.
Description: CRLF injection vulnerability in the mail function in PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 allows remote attackers to inject arbitrary e-mail headers and possibly conduct spam attacks via a control character immediately following folding of the (1) Subject or (2) To parameter, as demonstrated by a parameter containing a "\r\n\t\n" sequence, related to an increment bug in the SKIP_LONG_HEADER_SEP macro.
Family: unix Class: vulnerability
Reference(s): CVE-2007-1718
 Version: 5
Platform(s): Red Hat Enterprise Linux 3
CentOS Linux 3
Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
 Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:11575
 
Oval ID: oval:org.mitre.oval:def:11575
Title: Integer overflow in PHP 4.4.4 and earlier allows remote context-dependent attackers to execute arbitrary code via a long string to the unserialize function, which triggers the overflow in the ZVAL reference counter.
Description: Integer overflow in PHP 4.4.4 and earlier allows remote context-dependent attackers to execute arbitrary code via a long string to the unserialize function, which triggers the overflow in the ZVAL reference counter.
Family: unix Class: vulnerability
Reference(s): CVE-2007-1286
 Version: 5
Platform(s): Red Hat Enterprise Linux 3
CentOS Linux 3
Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
 Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:18873
 
Oval ID: oval:org.mitre.oval:def:18873
Title: DSA-1282-1 php4
Description: Several remote vulnerabilities have been discovered in PHP, a server-side, HTML-embedded scripting language, which may lead to the execution of arbitrary code.
Family: unix Class: patch
Reference(s): DSA-1282-1
CVE-2007-1286
CVE-2007-1380
CVE-2007-1521
CVE-2007-1711
CVE-2007-1718
CVE-2007-1777
 Version: 5
Platform(s): Debian GNU/Linux 4.0
 Product(s): php4
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 340

OpenVAS Exploits

Date Description
2012-06-21 Name : PHP version smaller than 5.2.1
File : nvt/nopsec_php_5_2_1.nasl
2012-06-21 Name : PHP version smaller than 4.4.5
File : nvt/nopsec_php_4_4_5.nasl
2010-04-23 Name : PHP PHP_Binary Heap Information Leak Vulnerability
File : nvt/gb_php_22805.nasl
2010-04-23 Name : PHP Zip_Entry_Read() Integer Overflow Vulnerability
File : nvt/gb_php_23169.nasl
2009-11-17 Name : Mac OS X Version
File : nvt/macosx_version.nasl
2009-10-10 Name : SLES9: Security update for PHP4
File : nvt/sles9p5017282.nasl
2009-04-09 Name : Mandriva Update for php MDKSA-2007:089 (php)
File : nvt/gb_mandriva_MDKSA_2007_089.nasl
2009-04-09 Name : Mandriva Update for php MDKSA-2007:090 (php)
File : nvt/gb_mandriva_MDKSA_2007_090.nasl
2009-03-23 Name : Ubuntu Update for php5 vulnerabilities USN-455-1
File : nvt/gb_ubuntu_USN_455_1.nasl
2009-02-27 Name : Fedora Update for php FEDORA-2007-415
File : nvt/gb_fedora_2007_415_php_fc6.nasl
2009-02-27 Name : Fedora Update for php FEDORA-2007-455
File : nvt/gb_fedora_2007_455_php_fc5.nasl
2009-02-27 Name : Fedora Update for php FEDORA-2007-526
File : nvt/gb_fedora_2007_526_php_fc5.nasl
2009-01-28 Name : SuSE Update for php4,php5 SUSE-SA:2007:020
File : nvt/gb_suse_2007_020.nasl
2009-01-28 Name : SuSE Update for php4,php5 SUSE-SA:2007:032
File : nvt/gb_suse_2007_032.nasl
2008-09-24 Name : Gentoo Security Advisory GLSA 200705-19 (php)
File : nvt/glsa_200705_19.nasl
2008-09-24 Name : Gentoo Security Advisory GLSA 200703-21 (php)
File : nvt/glsa_200703_21.nasl
2008-01-17 Name : Debian Security Advisory DSA 1282-1 (php4)
File : nvt/deb_1282_1.nasl
2008-01-17 Name : Debian Security Advisory DSA 1283-1 (php5)
File : nvt/deb_1283_1.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
33949 PHP zip_entry_read() Function ZIP Archive Handling Overflow

PHP contains a flaw that may allow a remote attacker to elevate privileges. The issue is due to the zip_read_entry function not properly sanitizing user-supplied input. By using a ZIP archive that contains a crafted length value, an attacker can trigger an integer overflow during an emalloc call.
33948 PHP mail() Function Arbitrary Mail Sending

PHP contains a flaw that may allow a remote attacker to manipulate mail functionality. The issue is due to mail function not properly sanitizing user-supplied input. By supplying CRLF (newline) characters, an attacker can inject arbitrary e-mail headers which may allow them to send mail to arbitrary hosts by supplying a control character after a Subject: or TO: parameter.
33946 PHP session_decode() Double-free Arbitrary Code Execution

PHP contains a flaw that may allow a context-dependent attacker to elevate privileges. The issue is due to the unserializer not properly validating user-supplied input. By passing crafted data, an attacker can overwrite variables pointing to the GLOBALS array or the session data in _SESSION allowing for the execution of arbitrary code.
33936 PHP session_regenerate_id() Function Double-free Arbitrary Code Execution

PHP contains a flaw that may allow a context-dependent attacker to gain elevated privileges. The issue occurs when an attacker interrupts the session_regenerate_id function (i.e. by calling a userspace error handler) which triggers a double free. This may allow an attacker to execute arbitrary code.
32776 PHP Session Extension php_binary Heap Information Disclosure

The php_binary serialization handler in the PHP session extension is missing a boundary check and may lead to an unauthorized information disclosure. The condition is triggered during the extraction of an overly long php_binary session data format variable name, which will disclose up to 126 bytes of heap data into PHP variables, resulting in a loss of confidentiality.
32771 PHP unserialize() ZVAL Reference Counter Remote Overflow

PHP contains a flaw that may a context-dependent attacker to elevate privileges. The issue can occur when the unserialize() function is used on an attacker supplied string, which can result in an integer overflow in the refcount variable in _zval_struct through the creation of a large number of references for a specific variable leading to a double destruction of the underlying variable. It is possible that the flaw may allow a remote attacker to execute arbitrary code resulting in a loss of integrity.

Snort® IPS/IDS

Date Description
2015-05-08 PHP 4 unserialize ZVAL Reference Counter Overflow attempt
RuleID : 34027 - Revision : 3 - Type : SERVER-OTHER

Nessus® Vulnerability Scanner

Date Description
2014-10-10 Name : The remote device is missing a vendor-supplied security patch.
File : f5_bigip_SOL7859.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2007-0155.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2007-0076.nasl - Type : ACT_GATHER_INFO
2009-04-23 Name : The remote Mandrake Linux host is missing one or more security updates.
File : mandrake_MDKSA-2007-090.nasl - Type : ACT_GATHER_INFO
2007-12-13 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_apache2-mod_php5-3290.nasl - Type : ACT_GATHER_INFO
2007-11-10 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-455-1.nasl - Type : ACT_GATHER_INFO
2007-10-17 Name : The remote openSUSE host is missing a security update.
File : suse_apache2-mod_php5-3289.nasl - Type : ACT_GATHER_INFO
2007-08-02 Name : The remote host is missing a Mac OS X update that fixes various security issues.
File : macosx_SecUpd2007-007.nasl - Type : ACT_GATHER_INFO
2007-05-29 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200705-19.nasl - Type : ACT_GATHER_INFO
2007-05-25 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2007-0153.nasl - Type : ACT_GATHER_INFO
2007-05-25 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2007-0082.nasl - Type : ACT_GATHER_INFO
2007-05-04 Name : The remote web server uses a version of PHP that is affected by multiple flaws.
File : php_4_4_7_or_5_2_2.nasl - Type : ACT_GATHER_INFO
2007-04-30 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1283.nasl - Type : ACT_GATHER_INFO
2007-04-30 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2007-0153.nasl - Type : ACT_GATHER_INFO
2007-04-30 Name : The remote Mandrake Linux host is missing one or more security updates.
File : mandrake_MDKSA-2007-089.nasl - Type : ACT_GATHER_INFO
2007-04-30 Name : The remote Fedora Core host is missing a security update.
File : fedora_2007-455.nasl - Type : ACT_GATHER_INFO
2007-04-30 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1282.nasl - Type : ACT_GATHER_INFO
2007-04-19 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2007-0155.nasl - Type : ACT_GATHER_INFO
2007-04-19 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2007-0154.nasl - Type : ACT_GATHER_INFO
2007-04-19 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2007-0155.nasl - Type : ACT_GATHER_INFO
2007-04-19 Name : The remote Fedora Core host is missing a security update.
File : fedora_2007-415.nasl - Type : ACT_GATHER_INFO
2007-04-02 Name : The remote web server uses a version of PHP that is affected by multiple flaws.
File : php_4_4_5.nasl - Type : ACT_GATHER_INFO
2007-04-02 Name : The remote web server uses a version of PHP that is affected by multiple flaws.
File : php_5_2_1.nasl - Type : ACT_GATHER_INFO
2007-03-26 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200703-21.nasl - Type : ACT_GATHER_INFO
2007-02-23 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2007-0081.nasl - Type : ACT_GATHER_INFO
2007-02-23 Name : The remote Mandrake Linux host is missing one or more security updates.
File : mandrake_MDKSA-2007-048.nasl - Type : ACT_GATHER_INFO
2007-02-21 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2007-0076.nasl - Type : ACT_GATHER_INFO
2007-02-21 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2007-0076.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
Date Informations
2014-02-17 11:26:35
  • Multiple Updates