Executive Summary
Summary | |
---|---|
Title | php security update |
Informations | |||
---|---|---|---|
Name | RHSA-2006:0276 | First vendor Publication | 2006-04-25 |
Vendor | RedHat | Last vendor Modification | 2006-04-25 |
Severity (Vendor) | Moderate | Revision | 01 |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P) | |||
---|---|---|---|
Cvss Base Score | 7.5 | Attack Range | Network |
Cvss Impact Score | 6.4 | Attack Complexity | Low |
Cvss Expoit Score | 10 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
Problem Description: Updated PHP packages that fix multiple security issues are now available for Red Hat Enterprise Linux 3 and 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Desktop version 3 - i386, x86_64 Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 3. Problem description: PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server. The phpinfo() PHP function did not properly sanitize long strings. An attacker could use this to perform cross-site scripting attacks against sites that have publicly-available PHP scripts that call phpinfo(). (CVE-2006-0996) The html_entity_decode() PHP function was found to not be binary safe. An attacker could use this flaw to disclose a certain part of the memory. In order for this issue to be exploitable the target site would need to have a PHP script which called the "html_entity_decode()" function with untrusted input from the user and displayed the result. (CVE-2006-1490) The error handling output was found to not properly escape HTML output in certain cases. An attacker could use this flaw to perform cross-site scripting attacks against sites where both display_errors and html_errors are enabled. (CVE-2006-0208) An input validation error was found in the "mb_send_mail()" function. An attacker could use this flaw to inject arbitrary headers in a mail sent via a script calling the "mb_send_mail()" function where the "To" parameter can be controlled by the attacker. (CVE-2005-3883) A buffer overflow flaw was discovered in uw-imap, the University of Washington's IMAP Server. php-imap is compiled against the static c-client libraries from imap and therefore needed to be recompiled against the fixed version. This issue only affected Red Hat Enterprise Linux 3. (CVE-2005-2933). Users of PHP should upgrade to these updated packages, which contain backported patches that resolve these issues. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via Red Hat Network. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. 5. Bug IDs fixed (http://bugzilla.redhat.com/): 163490 - PEAR::DB autoExecute function does not work when updating with WHERE clause 174463 - CVE-2005-3883 PHP mb_send_mail() header parsing issue 174528 - CVE-2005-2933 imap buffer overflow 178028 - CVE-2006-0208 PHP Cross Site Scripting (XSS) flaw 182719 - ImageCreateFromGif does not clean up its temporary file 187230 - CVE-2006-1490 PHP memory disclosure issue 187510 - CVE-2006-0996 phpinfo() XSS issue |
Original Source
Url : https://rhn.redhat.com/errata/RHSA-2006-0276.html |
CAPEC : Common Attack Pattern Enumeration & Classification
Id | Name |
---|---|
CAPEC-15 | Command Delimiters |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
100 % | CWE-79 | Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25) |
OVAL Definitions
Definition Id: oval:org.mitre.oval:def:10064 | |||
Oval ID: | oval:org.mitre.oval:def:10064 | ||
Title: | Multiple cross-site scripting (XSS) vulnerabilities in PHP 4.4.1 and 5.1.1, when display_errors and html_errors are on, allow remote attackers to inject arbitrary web script or HTML via inputs to PHP applications that are not filtered when they are included in the resulting error message. | ||
Description: | Multiple cross-site scripting (XSS) vulnerabilities in PHP 4.4.1 and 5.1.1, when display_errors and html_errors are on, allow remote attackers to inject arbitrary web script or HTML via inputs to PHP applications that are not filtered when they are included in the resulting error message. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2006-0208 | Version: | 5 |
Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:10997 | |||
Oval ID: | oval:org.mitre.oval:def:10997 | ||
Title: | Cross-site scripting (XSS) vulnerability in phpinfo (info.c) in PHP 5.1.2 and 4.4.2 allows remote attackers to inject arbitrary web script or HTML via long array variables, including (1) a large number of dimensions or (2) long values, which prevents HTML tags from being removed. | ||
Description: | Cross-site scripting (XSS) vulnerability in phpinfo (info.c) in PHP 5.1.2 and 4.4.2 allows remote attackers to inject arbitrary web script or HTML via long array variables, including (1) a large number of dimensions or (2) long values, which prevents HTML tags from being removed. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2006-0996 | Version: | 5 |
Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:11084 | |||
Oval ID: | oval:org.mitre.oval:def:11084 | ||
Title: | PHP before 5.1.3-RC1 might allow remote attackers to obtain portions of memory via crafted binary data sent to a script that processes user input in the html_entity_decode function and sends the encoded results back to the client, aka a "binary safety" issue. NOTE: this issue has been referred to as a "memory leak," but it is an information leak that discloses memory contents. | ||
Description: | PHP before 5.1.3-RC1 might allow remote attackers to obtain portions of memory via crafted binary data sent to a script that processes user input in the html_entity_decode function and sends the encoded results back to the client, aka a "binary safety" issue. NOTE: this issue has been referred to as a "memory leak," but it is an information leak that discloses memory contents. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2006-1490 | Version: | 5 |
Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:9858 | |||
Oval ID: | oval:org.mitre.oval:def:9858 | ||
Title: | Buffer overflow in the mail_valid_net_parse_work function in mail.c for Washington's IMAP Server (UW-IMAP) before imap-2004g allows remote attackers to execute arbitrary code via a mailbox name containing a single double-quote (") character without a closing quote, which causes bytes after the double-quote to be copied into a buffer indefinitely. | ||
Description: | Buffer overflow in the mail_valid_net_parse_work function in mail.c for Washington's IMAP Server (UW-IMAP) before imap-2004g allows remote attackers to execute arbitrary code via a mailbox name containing a single double-quote (") character without a closing quote, which causes bytes after the double-quote to be copied into a buffer indefinitely. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2005-2933 | Version: | 5 |
Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
Definition Synopsis: | |||
|
CPE : Common Platform Enumeration
OpenVAS Exploits
Date | Description |
---|---|
2012-06-21 | Name : PHP version smaller than 5.1.0 File : nvt/nopsec_php_5_1_0.nasl |
2012-06-21 | Name : PHP version smaller than 5.1.2 File : nvt/nopsec_php_5_1_2.nasl |
2009-11-17 | Name : Mac OS X Version File : nvt/macosx_version.nasl |
2009-10-10 | Name : SLES9: Security update for PHP4 File : nvt/sles9p5014967.nasl |
2009-10-10 | Name : SLES9: Security update for PHP4 File : nvt/sles9p5015639.nasl |
2008-09-24 | Name : Gentoo Security Advisory GLSA 200510-10 (uw-imap) File : nvt/glsa_200510_10.nasl |
2008-09-24 | Name : Gentoo Security Advisory GLSA 200603-22 (php) File : nvt/glsa_200603_22.nasl |
2008-09-24 | Name : Gentoo Security Advisory GLSA 200605-08 (php) File : nvt/glsa_200605_08.nasl |
2008-09-04 | Name : FreeBSD Ports: imap-uw File : nvt/freebsd_imap-uw0.nasl |
2008-01-17 | Name : Debian Security Advisory DSA 861-1 (uw-imap) File : nvt/deb_861_1.nasl |
Open Source Vulnerability Database (OSVDB)
Id | Description |
---|---|
24484 | PHP phpinfo() Function Long Array XSS PHP contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not correctly validate large array values upon submission to the phpinfo() function. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity. |
24248 | PHP html_entity_decode() Function Memory Content Disclosure |
22480 | PHP Unspecified Error Condition XSS PHP contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate the user-supplied input upon submission to the PHP 'Error Message' scripts. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server. |
21239 | PHP mb_send_mail() To: Field Arbitrary Mail Header Injection |
19856 | UW-IMAP Netmailbox Name mail_valid_net_parse_work() Function Overflow A remote overflow exists in UW-imapd. The mail_valid_net_parse_work() function in 'src/c-client/mail.c' fails to properly validate the user-supplied mailbox name resulting in a stack overflow. With a specially crafted request, a remote authenticated attacker can cause arbitrary code execution resulting in a loss of integrity. |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2011-11-18 | Name : The remote web server uses a version of PHP that is affected by multiple vuln... File : php_5_1_2.nasl - Type : ACT_GATHER_INFO |
2011-11-18 | Name : The remote web server uses a version of PHP that is affected by multiple vuln... File : php_5_1_0.nasl - Type : ACT_GATHER_INFO |
2011-11-18 | Name : The remote web server uses a version of PHP that is affected by multiple cros... File : php_4_4_2.nasl - Type : ACT_GATHER_INFO |
2011-05-28 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2005-310-06.nasl - Type : ACT_GATHER_INFO |
2007-11-10 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-320-1.nasl - Type : ACT_GATHER_INFO |
2007-01-17 | Name : The remote Fedora Core host is missing a security update. File : fedora_2006-289.nasl - Type : ACT_GATHER_INFO |
2006-08-25 | Name : The remote web server uses a version of PHP that is affected by multiple flaws. File : php_4_4_3.nasl - Type : ACT_GATHER_INFO |
2006-07-05 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2005-848.nasl - Type : ACT_GATHER_INFO |
2006-07-03 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2005-850.nasl - Type : ACT_GATHER_INFO |
2006-07-03 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2006-0276.nasl - Type : ACT_GATHER_INFO |
2006-05-24 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2006-0501.nasl - Type : ACT_GATHER_INFO |
2006-05-13 | Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_1f6e2ade35c211da811d0050bf27ba24.nasl - Type : ACT_GATHER_INFO |
2006-05-13 | Name : The remote host is missing a vendor-supplied security patch File : suse_SA_2006_024.nasl - Type : ACT_GATHER_INFO |
2006-05-13 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200605-08.nasl - Type : ACT_GATHER_INFO |
2006-04-26 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2006-074.nasl - Type : ACT_GATHER_INFO |
2006-04-26 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2006-0276.nasl - Type : ACT_GATHER_INFO |
2006-04-04 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2006-063.nasl - Type : ACT_GATHER_INFO |
2006-03-23 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200603-22.nasl - Type : ACT_GATHER_INFO |
2006-03-13 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-261-1.nasl - Type : ACT_GATHER_INFO |
2006-02-05 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2006-028.nasl - Type : ACT_GATHER_INFO |
2006-01-21 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-232-1.nasl - Type : ACT_GATHER_INFO |
2006-01-15 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2005-238.nasl - Type : ACT_GATHER_INFO |
2005-12-20 | Name : The remote host is missing a vendor-supplied security patch File : suse_SA_2005_069.nasl - Type : ACT_GATHER_INFO |
2005-12-07 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2005-848.nasl - Type : ACT_GATHER_INFO |
2005-12-07 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2005-850.nasl - Type : ACT_GATHER_INFO |
2005-11-02 | Name : The remote Mandrake Linux host is missing a security update. File : mandrake_MDKSA-2005-194.nasl - Type : ACT_GATHER_INFO |
2005-11-02 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2005-189.nasl - Type : ACT_GATHER_INFO |
2005-10-19 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200510-10.nasl - Type : ACT_GATHER_INFO |
2005-10-11 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-861.nasl - Type : ACT_GATHER_INFO |
2005-10-06 | Name : The remote IMAP server is prone to a buffer overflow. File : uw_imap_mailbox_overflow.nasl - Type : ACT_DESTRUCTIVE_ATTACK |
Alert History
Date | Informations |
---|---|
2014-02-17 11:49:58 |
|