Executive Summary
This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
| Summary | |
|---|---|
| Title | php security update |
| Informations | |||
|---|---|---|---|
| Name | RHSA-2006:0501 | First vendor Publication | 2006-05-23 |
| Vendor | RedHat | Last vendor Modification | 2006-05-23 |
| Severity (Vendor) | Moderate | Revision | 02 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 7.5 | Attack Range | Network |
| Cvss Impact Score | 6.4 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Problem Description: Updated PHP packages that fix multiple security issues are now available for Red Hat Enterprise Linux 2.1. This update has been rated as having moderate security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386, ia64 Red Hat Linux Advanced Workstation 2.1 - ia64 Red Hat Enterprise Linux ES version 2.1 - i386 Red Hat Enterprise Linux WS version 2.1 - i386 3. Problem description: PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server. The phpinfo() PHP function did not properly sanitize long strings. An attacker could use this to perform cross-site scripting attacks against sites that have publicly-available PHP scripts that call phpinfo(). (CVE-2006-0996) The error handling output was found to not properly escape HTML output in certain cases. An attacker could use this flaw to perform cross-site scripting attacks against sites where both display_errors and html_errors are enabled. (CVE-2006-0208) A buffer overflow flaw was discovered in uw-imap, the University of Washington's IMAP Server. php-imap is compiled against the static c-client libraries from imap and therefore needed to be recompiled against the fixed version. (CVE-2005-2933) The wordwrap() PHP function did not properly check for integer overflow in the handling of the "break" parameter. An attacker who could control the string passed to the "break" parameter could cause a heap overflow. (CVE-2006-1990) Users of PHP should upgrade to these updated packages, which contain backported patches that resolve these issues. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via Red Hat Network. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. 5. Bug IDs fixed (http://bugzilla.redhat.com/): 104249 - php SRPM has silent IMAP dependency 190519 - CVE-2006-0208 PHP Cross Site Scripting (XSS) flaw 190524 - CVE-2005-2933 imap buffer overflow 190526 - CVE-2006-0996 phpinfo() XSS issue 191474 - CVE-2006-1990 php wordwrap integer overflow |
Original Source
| Url : https://rhn.redhat.com/errata/RHSA-2006-0501.html |
CAPEC : Common Attack Pattern Enumeration & Classification
| Id | Name |
|---|---|
| CAPEC-15 | Command Delimiters |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-79 | Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25) |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:10064 | |||
| Oval ID: | oval:org.mitre.oval:def:10064 | ||
| Title: | Multiple cross-site scripting (XSS) vulnerabilities in PHP 4.4.1 and 5.1.1, when display_errors and html_errors are on, allow remote attackers to inject arbitrary web script or HTML via inputs to PHP applications that are not filtered when they are included in the resulting error message. | ||
| Description: | Multiple cross-site scripting (XSS) vulnerabilities in PHP 4.4.1 and 5.1.1, when display_errors and html_errors are on, allow remote attackers to inject arbitrary web script or HTML via inputs to PHP applications that are not filtered when they are included in the resulting error message. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2006-0208 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:10997 | |||
| Oval ID: | oval:org.mitre.oval:def:10997 | ||
| Title: | Cross-site scripting (XSS) vulnerability in phpinfo (info.c) in PHP 5.1.2 and 4.4.2 allows remote attackers to inject arbitrary web script or HTML via long array variables, including (1) a large number of dimensions or (2) long values, which prevents HTML tags from being removed. | ||
| Description: | Cross-site scripting (XSS) vulnerability in phpinfo (info.c) in PHP 5.1.2 and 4.4.2 allows remote attackers to inject arbitrary web script or HTML via long array variables, including (1) a large number of dimensions or (2) long values, which prevents HTML tags from being removed. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2006-0996 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:9696 | |||
| Oval ID: | oval:org.mitre.oval:def:9696 | ||
| Title: | Integer overflow in the wordwrap function in string.c in PHP 4.4.2 and 5.1.2 might allow context-dependent attackers to execute arbitrary code via certain long arguments that cause a small buffer to be allocated, which triggers a heap-based buffer overflow in a memcpy function call, a different vulnerability than CVE-2002-1396. | ||
| Description: | Integer overflow in the wordwrap function in string.c in PHP 4.4.2 and 5.1.2 might allow context-dependent attackers to execute arbitrary code via certain long arguments that cause a small buffer to be allocated, which triggers a heap-based buffer overflow in a memcpy function call, a different vulnerability than CVE-2002-1396. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2006-1990 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:9858 | |||
| Oval ID: | oval:org.mitre.oval:def:9858 | ||
| Title: | Buffer overflow in the mail_valid_net_parse_work function in mail.c for Washington's IMAP Server (UW-IMAP) before imap-2004g allows remote attackers to execute arbitrary code via a mailbox name containing a single double-quote (") character without a closing quote, which causes bytes after the double-quote to be copied into a buffer indefinitely. | ||
| Description: | Buffer overflow in the mail_valid_net_parse_work function in mail.c for Washington's IMAP Server (UW-IMAP) before imap-2004g allows remote attackers to execute arbitrary code via a mailbox name containing a single double-quote (") character without a closing quote, which causes bytes after the double-quote to be copied into a buffer indefinitely. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2005-2933 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2012-06-21 | Name : PHP version smaller than 5.1.2 File : nvt/nopsec_php_5_1_2.nasl |
| 2009-11-17 | Name : Mac OS X Version File : nvt/macosx_version.nasl |
| 2009-10-10 | Name : SLES9: Security update for PHP4 File : nvt/sles9p5015639.nasl |
| 2008-09-24 | Name : Gentoo Security Advisory GLSA 200510-10 (uw-imap) File : nvt/glsa_200510_10.nasl |
| 2008-09-24 | Name : Gentoo Security Advisory GLSA 200603-22 (php) File : nvt/glsa_200603_22.nasl |
| 2008-09-24 | Name : Gentoo Security Advisory GLSA 200605-08 (php) File : nvt/glsa_200605_08.nasl |
| 2008-09-04 | Name : FreeBSD Ports: imap-uw File : nvt/freebsd_imap-uw0.nasl |
| 2008-01-17 | Name : Debian Security Advisory DSA 861-1 (uw-imap) File : nvt/deb_861_1.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 24944 | PHP wordwrap() Function Overflow PHP contains a flaw that may allow a context-dependent attacker to gain elevated privileges. The issue is due the wordwrap function in string.c not properly sanitizing user-supplied input. By passing a crafted string an attacker could trigger a heap-based buffer overflow and execute arbitrary code. |
| 24484 | PHP phpinfo() Function Long Array XSS PHP contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not correctly validate large array values upon submission to the phpinfo() function. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity. |
| 22480 | PHP Unspecified Error Condition XSS PHP contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate the user-supplied input upon submission to the PHP 'Error Message' scripts. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server. |
| 19856 | UW-IMAP Netmailbox Name mail_valid_net_parse_work() Function Overflow A remote overflow exists in UW-imapd. The mail_valid_net_parse_work() function in 'src/c-client/mail.c' fails to properly validate the user-supplied mailbox name resulting in a stack overflow. With a specially crafted request, a remote authenticated attacker can cause arbitrary code execution resulting in a loss of integrity. |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2011-11-18 | Name : The remote web server uses a version of PHP that is affected by multiple vuln... File : php_5_1_2.nasl - Type : ACT_GATHER_INFO |
| 2011-11-18 | Name : The remote web server uses a version of PHP that is affected by multiple cros... File : php_4_4_2.nasl - Type : ACT_GATHER_INFO |
| 2011-05-28 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2005-310-06.nasl - Type : ACT_GATHER_INFO |
| 2007-11-10 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-320-1.nasl - Type : ACT_GATHER_INFO |
| 2007-10-17 | Name : The remote openSUSE host is missing a security update. File : suse_php5-1590.nasl - Type : ACT_GATHER_INFO |
| 2007-02-18 | Name : The remote host is missing a vendor-supplied security patch File : suse_SA_2006_031.nasl - Type : ACT_GATHER_INFO |
| 2007-01-17 | Name : The remote Fedora Core host is missing a security update. File : fedora_2006-289.nasl - Type : ACT_GATHER_INFO |
| 2006-08-25 | Name : The remote web server uses a version of PHP that is affected by multiple flaws. File : php_4_4_3.nasl - Type : ACT_GATHER_INFO |
| 2006-07-17 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2006-122.nasl - Type : ACT_GATHER_INFO |
| 2006-07-13 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2006-0568.nasl - Type : ACT_GATHER_INFO |
| 2006-07-13 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2006-0568.nasl - Type : ACT_GATHER_INFO |
| 2006-07-05 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2005-848.nasl - Type : ACT_GATHER_INFO |
| 2006-07-03 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2005-850.nasl - Type : ACT_GATHER_INFO |
| 2006-07-03 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2006-0276.nasl - Type : ACT_GATHER_INFO |
| 2006-05-27 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2006-091.nasl - Type : ACT_GATHER_INFO |
| 2006-05-24 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2006-0501.nasl - Type : ACT_GATHER_INFO |
| 2006-05-13 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200605-08.nasl - Type : ACT_GATHER_INFO |
| 2006-05-13 | Name : The remote host is missing a vendor-supplied security patch File : suse_SA_2006_024.nasl - Type : ACT_GATHER_INFO |
| 2006-05-13 | Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_1f6e2ade35c211da811d0050bf27ba24.nasl - Type : ACT_GATHER_INFO |
| 2006-04-26 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2006-074.nasl - Type : ACT_GATHER_INFO |
| 2006-04-26 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2006-0276.nasl - Type : ACT_GATHER_INFO |
| 2006-03-23 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200603-22.nasl - Type : ACT_GATHER_INFO |
| 2006-03-13 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-261-1.nasl - Type : ACT_GATHER_INFO |
| 2006-02-05 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2006-028.nasl - Type : ACT_GATHER_INFO |
| 2005-12-07 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2005-848.nasl - Type : ACT_GATHER_INFO |
| 2005-12-07 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2005-850.nasl - Type : ACT_GATHER_INFO |
| 2005-11-02 | Name : The remote Mandrake Linux host is missing a security update. File : mandrake_MDKSA-2005-194.nasl - Type : ACT_GATHER_INFO |
| 2005-11-02 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2005-189.nasl - Type : ACT_GATHER_INFO |
| 2005-10-19 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200510-10.nasl - Type : ACT_GATHER_INFO |
| 2005-10-11 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-861.nasl - Type : ACT_GATHER_INFO |
| 2005-10-06 | Name : The remote IMAP server is prone to a buffer overflow. File : uw_imap_mailbox_overflow.nasl - Type : ACT_DESTRUCTIVE_ATTACK |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:50:03 |
|
