Executive Summary

Summary
Titlephp security update
Informations
NameRHSA-2012:0570First vendor Publication2012-05-11
VendorRedHatLast vendor Modification2012-05-11
Severity (Vendor) CriticalRevision01

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Cvss Base Score7.5Attack RangeNetwork
Cvss Impact Score6.4Attack ComplexityLow
Cvss Expoit Score10AuthenticationNone Required
Calculate full CVSS 2.0 Vectors scores

Detail

Problem Description:

Updated php packages that fix one security issue are now available for
Red Hat Application Stack v2.

The Red Hat Security Response Team has rated this update as having critical
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.

2. Relevant releases/architectures:

Red Hat Application Stack v2 for Enterprise Linux (v.5) - i386, x86_64

3. Description:

PHP is an HTML-embedded scripting language commonly used with the Apache
HTTP Server.

A flaw was found in the way the php-cgi executable processed command line
arguments when running in CGI mode. A remote attacker could send a
specially-crafted request to a PHP script that would result in the query
string being parsed by php-cgi as command line options and arguments. This
could lead to the disclosure of the script's source code or arbitrary code
execution with the privileges of the PHP interpreter. (CVE-2012-1823)

Red Hat is aware that a public exploit for this issue is available that
allows remote code execution in affected PHP CGI configurations. This flaw
does not affect the default configuration using the PHP module for Apache
httpd to handle PHP scripts.

All php users should upgrade to these updated packages, which contain a
backported patch to resolve this issue. After installing the updated
packages, the httpd daemon must be restarted for the update to take effect.

4. Solution:

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

5. Bugs fixed (http://bugzilla.redhat.com/):

818607 - CVE-2012-1823 php: command line arguments injection when run in CGI mode (VU#520827)

Original Source

Url : https://rhn.redhat.com/errata/RHSA-2012-0570.html

CWE : Common Weakness Enumeration

idName
CWE-20Improper Input Validation

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:21416
 
Oval ID: oval:org.mitre.oval:def:21416
Title: RHSA-2012:0547: php53 security update (Critical)
Description: sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.
Family: unix Class: patch
Reference(s): RHSA-2012:0547-00
CESA-2012:0547
CVE-2012-1823
Version: 4
Platform(s): Red Hat Enterprise Linux 5
CentOS Linux 5
Product(s): php53
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:21394
 
Oval ID: oval:org.mitre.oval:def:21394
Title: RHSA-2012:0546: php security update (Critical)
Description: sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.
Family: unix Class: patch
Reference(s): RHSA-2012:0546-01
CESA-2012:0546
CVE-2012-1823
Version: 4
Platform(s): Red Hat Enterprise Linux 5
Red Hat Enterprise Linux 6
CentOS Linux 5
CentOS Linux 6
Product(s): php
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:19063
 
Oval ID: oval:org.mitre.oval:def:19063
Title: HP-UX Apache Web Server running PHP, Remote Execution of Arbitrary Code, Privilege Elevation, Denial of Service (DoS)
Description: sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.
Family: unix Class: vulnerability
Reference(s): CVE-2012-1823
Version: 7
Platform(s): HP-UX 11
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23798
 
Oval ID: oval:org.mitre.oval:def:23798
Title: ELSA-2012:0546: php security update (Critical)
Description: sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.
Family: unix Class: patch
Reference(s): ELSA-2012:0546-01
CVE-2012-1823
Version: 3
Platform(s): Oracle Linux 5
Oracle Linux 6
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23389
 
Oval ID: oval:org.mitre.oval:def:23389
Title: ELSA-2012:0546: php security update (Critical)
Description: sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.
Family: unix Class: patch
Reference(s): ELSA-2012:0546-01
CVE-2012-1823
Version: 3
Platform(s): Oracle Linux 5
Oracle Linux 6
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:22882
 
Oval ID: oval:org.mitre.oval:def:22882
Title: ELSA-2012:0547: php53 security update (Critical)
Description: sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.
Family: unix Class: patch
Reference(s): ELSA-2012:0547-00
CVE-2012-1823
Version: 3
Platform(s): Oracle Linux 5
Product(s):
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application52

SAINT Exploits

DescriptionLink
PHP CGI Query String Parameters Command ExecutionMore info here

ExploitDB Exploits

idDescription
2013-10-29Apache / PHP 5.x Remote Code Execution Exploit
2013-06-05Plesk Apache Zeroday Remote Exploit
2012-05-05PHP CGI Argument Injection Exploit
2012-05-04PHP CGI Argument Injection

OpenVAS Exploits

DateDescription
2012-12-13Name : SuSE Update for update openSUSE-SU-2012:0590-1 (update)
File : nvt/gb_suse_2012_0590_1.nasl
2012-09-26Name : Gentoo Security Advisory GLSA 201209-03 (php)
File : nvt/glsa_201209_03.nasl
2012-09-25Name : Mac OS X v10.6.8 Multiple Vulnerabilities (2012-004)
File : nvt/gb_macosx_su12-004.nasl
2012-08-30Name : Fedora Update for maniadrive FEDORA-2012-7628
File : nvt/gb_fedora_2012_7628_maniadrive_fc17.nasl
2012-08-30Name : Fedora Update for php FEDORA-2012-7628
File : nvt/gb_fedora_2012_7628_php_fc17.nasl
2012-08-30Name : Fedora Update for php FEDORA-2012-10936
File : nvt/gb_fedora_2012_10936_php_fc17.nasl
2012-08-30Name : Fedora Update for php FEDORA-2012-9490
File : nvt/gb_fedora_2012_9490_php_fc17.nasl
2012-08-06Name : Fedora Update for php FEDORA-2012-10908
File : nvt/gb_fedora_2012_10908_php_fc16.nasl
2012-08-03Name : Mandriva Update for php MDVSA-2012:068 (php)
File : nvt/gb_mandriva_MDVSA_2012_068.nasl
2012-08-03Name : Mandriva Update for php MDVSA-2012:068-1 (php)
File : nvt/gb_mandriva_MDVSA_2012_068_1.nasl
2012-07-30Name : CentOS Update for php CESA-2012:0546 centos5
File : nvt/gb_CESA-2012_0546_php_centos5.nasl
2012-07-30Name : CentOS Update for php CESA-2012:0546 centos6
File : nvt/gb_CESA-2012_0546_php_centos6.nasl
2012-07-30Name : CentOS Update for php53 CESA-2012:0547 centos5
File : nvt/gb_CESA-2012_0547_php53_centos5.nasl
2012-07-30Name : CentOS Update for php CESA-2012:1045 centos5
File : nvt/gb_CESA-2012_1045_php_centos5.nasl
2012-07-30Name : CentOS Update for php CESA-2012:1046 centos6
File : nvt/gb_CESA-2012_1046_php_centos6.nasl
2012-07-30Name : CentOS Update for php53 CESA-2012:1047 centos5
File : nvt/gb_CESA-2012_1047_php53_centos5.nasl
2012-07-03Name : Fedora Update for php FEDORA-2012-9762
File : nvt/gb_fedora_2012_9762_php_fc16.nasl
2012-06-28Name : RedHat Update for php RHSA-2012:1045-01
File : nvt/gb_RHSA-2012_1045-01_php.nasl
2012-06-28Name : RedHat Update for php RHSA-2012:1046-01
File : nvt/gb_RHSA-2012_1046-01_php.nasl
2012-06-28Name : RedHat Update for php53 RHSA-2012:1047-01
File : nvt/gb_RHSA-2012_1047-01_php53.nasl
2012-05-31Name : FreeBSD Ports: php5
File : nvt/freebsd_php516.nasl
2012-05-31Name : FreeBSD Ports: php5
File : nvt/freebsd_php517.nasl
2012-05-31Name : Debian Security Advisory DSA 2465-1 (php5)
File : nvt/deb_2465_1.nasl
2012-05-28Name : Fedora Update for maniadrive FEDORA-2012-7567
File : nvt/gb_fedora_2012_7567_maniadrive_fc15.nasl
2012-05-28Name : Fedora Update for php-eaccelerator FEDORA-2012-7567
File : nvt/gb_fedora_2012_7567_php-eaccelerator_fc15.nasl
2012-05-28Name : Fedora Update for php FEDORA-2012-7567
File : nvt/gb_fedora_2012_7567_php_fc15.nasl
2012-05-28Name : Fedora Update for maniadrive FEDORA-2012-7586
File : nvt/gb_fedora_2012_7586_maniadrive_fc16.nasl
2012-05-28Name : Fedora Update for php-eaccelerator FEDORA-2012-7586
File : nvt/gb_fedora_2012_7586_php-eaccelerator_fc16.nasl
2012-05-28Name : Fedora Update for php FEDORA-2012-7586
File : nvt/gb_fedora_2012_7586_php_fc16.nasl
2012-05-08Name : RedHat Update for php RHSA-2012:0546-01
File : nvt/gb_RHSA-2012_0546-01_php.nasl
2012-05-08Name : RedHat Update for php53 RHSA-2012:0547-01
File : nvt/gb_RHSA-2012_0547-01_php53.nasl
2012-05-08Name : Ubuntu Update for php5 USN-1437-1
File : nvt/gb_ubuntu_USN_1437_1.nasl
2012-05-04Name : PHP-CGI-based setups vulnerability when parsing query string parameters from ...
File : nvt/gb_php_cgi_2012.nasl

Snort® IPS/IDS

DateDescription
2014-01-10PHP-CGI command injection attempt
RuleID : 22097 - Revision : 6 - Type : SERVER-WEBAPP
2014-01-10PHP-CGI command injection attempt
RuleID : 22064 - Revision : 7 - Type : SERVER-WEBAPP
2014-01-10PHP-CGI remote file include attempt
RuleID : 22063-community - Revision : 9 - Type : SERVER-WEBAPP
2014-01-10PHP-CGI remote file include attempt
RuleID : 22063 - Revision : 9 - Type : SERVER-WEBAPP

Metasploit Database

idDescription
2012-05-03 PHP CGI Argument Injection

Nessus® Vulnerability Scanner

DateDescription
2013-11-01Name : The remote web server contains a version of PHP that allows arbitrary code ex...
File : php_cgi_remote_code_execution.nasl - Type : ACT_ATTACK
2013-09-04Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2012-77.nasl - Type : ACT_GATHER_INFO
2013-07-23Name : The remote web server is affected by multiple vulnerabilities.
File : hpsmh_7_2_1_0.nasl - Type : ACT_GATHER_INFO
2013-07-12Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2012-0546.nasl - Type : ACT_GATHER_INFO
2013-07-12Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2012-0547.nasl - Type : ACT_GATHER_INFO
2013-07-12Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2012-1045.nasl - Type : ACT_GATHER_INFO
2013-07-12Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2012-1046.nasl - Type : ACT_GATHER_INFO
2013-07-12Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2012-1047.nasl - Type : ACT_GATHER_INFO
2013-06-28Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2012-1047.nasl - Type : ACT_GATHER_INFO
2013-01-25Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_apache2-mod_php5-120504.nasl - Type : ACT_GATHER_INFO
2013-01-25Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_apache2-mod_php53-120504.nasl - Type : ACT_GATHER_INFO
2013-01-24Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2012-0568.nasl - Type : ACT_GATHER_INFO
2013-01-24Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2012-0569.nasl - Type : ACT_GATHER_INFO
2012-09-24Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201209-03.nasl - Type : ACT_GATHER_INFO
2012-09-20Name : The remote host is missing a Mac OS X update that fixes several security issues.
File : macosx_10_7_5.nasl - Type : ACT_GATHER_INFO
2012-09-20Name : The remote host is missing a Mac OS X update that fixes several security issues.
File : macosx_10_8_2.nasl - Type : ACT_GATHER_INFO
2012-09-20Name : The remote host is missing a Mac OS X update that fixes several security issues.
File : macosx_SecUpd2012-004.nasl - Type : ACT_GATHER_INFO
2012-08-01Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20120507_php53_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-08-01Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20120507_php_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-08-01Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20120627_php53_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-08-01Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20120627_php_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-08-01Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20120627_php_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2012-07-11Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2012-1046.nasl - Type : ACT_GATHER_INFO
2012-07-05Name : The remote web server is affected by multiple vulnerabilities.
File : hpsmh_7_1_1_1.nasl - Type : ACT_GATHER_INFO
2012-06-28Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2012-1045.nasl - Type : ACT_GATHER_INFO
2012-06-28Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2012-1046.nasl - Type : ACT_GATHER_INFO
2012-06-28Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2012-1047.nasl - Type : ACT_GATHER_INFO
2012-06-28Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2012-1045.nasl - Type : ACT_GATHER_INFO
2012-05-29Name : The remote Fedora host is missing one or more security updates.
File : fedora_2012-7567.nasl - Type : ACT_GATHER_INFO
2012-05-29Name : The remote Fedora host is missing one or more security updates.
File : fedora_2012-7586.nasl - Type : ACT_GATHER_INFO
2012-05-29Name : The remote Fedora host is missing one or more security updates.
File : fedora_2012-7628.nasl - Type : ACT_GATHER_INFO
2012-05-14Name : The remote web server contains a version of PHP that allows arbitrary code ex...
File : php_cgi_query_string_code_execution.nasl - Type : ACT_ATTACK
2012-05-14Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_59b68b1e9c7811e1b5e0000c299b62e1.nasl - Type : ACT_GATHER_INFO
2012-05-10Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2465.nasl - Type : ACT_GATHER_INFO
2012-05-10Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2012-0547.nasl - Type : ACT_GATHER_INFO
2012-05-09Name : The remote web server uses a version of PHP that is affected by a remote code...
File : php_5_3_13.nasl - Type : ACT_GATHER_INFO
2012-05-09Name : The remote web server uses a version of PHP that is affected by multiple vuln...
File : php_5_4_3.nasl - Type : ACT_GATHER_INFO
2012-05-09Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_apache2-mod_php5-8114.nasl - Type : ACT_GATHER_INFO
2012-05-08Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2012-0546.nasl - Type : ACT_GATHER_INFO
2012-05-08Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2012-0547.nasl - Type : ACT_GATHER_INFO
2012-05-08Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2012-0546.nasl - Type : ACT_GATHER_INFO
2012-05-07Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-1437-1.nasl - Type : ACT_GATHER_INFO
2012-05-07Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_60de13d595f011e1806a001143cd36d8.nasl - Type : ACT_GATHER_INFO
2012-05-07Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2012-068.nasl - Type : ACT_GATHER_INFO
2012-05-04Name : The remote web server uses a version of PHP that is affected by a remote code...
File : php_5_4_2.nasl - Type : ACT_GATHER_INFO