Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Summary
Title PHP vulnerabilities
Informations
Name USN-2344-1 First vendor Publication 2014-09-10
Vendor Ubuntu Last vendor Modification 2014-09-10
Severity (Vendor) N/A Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Cvss Base Score 6.8 Attack Range Network
Cvss Impact Score 6.4 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 14.04 LTS - Ubuntu 12.04 LTS - Ubuntu 10.04 LTS

Summary:

php5 could be made to crash or run programs if it received specially crafted network traffic.

Software Description: - php5: HTML-embedded scripting language interpreter

Details:

It was discovered that the Fileinfo component in php5 contains an integer overflow. An attacker could use this flaw to cause a denial of service or possibly execute arbitrary code via a crafted CDF file. (CVE-2014-3587)

It was discovered that the php_parserr function contains multiple buffer overflows. An attacker could use this flaw to cause a denial of service or possibly execute arbitrary code via crafted DNS records. (CVE-2014-3597)

Update instructions:

The problem can be corrected by updating your system to the following package versions:

Ubuntu 14.04 LTS:
libapache2-mod-php5 5.5.9+dfsg-1ubuntu4.4
php5 5.5.9+dfsg-1ubuntu4.4
php5-cgi 5.5.9+dfsg-1ubuntu4.4
php5-fpm 5.5.9+dfsg-1ubuntu4.4

Ubuntu 12.04 LTS:
libapache2-mod-php5 5.3.10-1ubuntu3.14
php5 5.3.10-1ubuntu3.14
php5-cgi 5.3.10-1ubuntu3.14
php5-fpm 5.3.10-1ubuntu3.14

Ubuntu 10.04 LTS:
libapache2-mod-php5 5.3.2-1ubuntu4.27
php5 5.3.2-1ubuntu4.27
php5-cgi 5.3.2-1ubuntu4.27

After a standard system update you need to restart Apache or php5-fpm to make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-2344-1
CVE-2014-3587, CVE-2014-3597

Package Information:
https://launchpad.net/ubuntu/+source/php5/5.5.9+dfsg-1ubuntu4.4
https://launchpad.net/ubuntu/+source/php5/5.3.10-1ubuntu3.14
https://launchpad.net/ubuntu/+source/php5/5.3.2-1ubuntu4.27

Original Source

Url : http://www.ubuntu.com/usn/USN-2344-1

CWE : Common Weakness Enumeration

% Id Name
50 % CWE-189 Numeric Errors (CWE/SANS Top 25)
50 % CWE-119 Failure to Constrain Operations within the Bounds of a Memory Buffer

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:26455
 
Oval ID: oval:org.mitre.oval:def:26455
Title: DSA-3021-1 file - security update
Description: Multiple security issues have been found in file, a tool to determine a file type. These vulnerabilities allow remote attackers to cause a denial of service, via resource consumption or application crash.
Family: unix Class: patch
Reference(s): DSA-3021-1
CVE-2014-0207
CVE-2014-0237
CVE-2014-0238
CVE-2014-3478
CVE-2014-3479
CVE-2014-3480
CVE-2014-3487
CVE-2014-3538
CVE-2014-3587
Version: 3
Platform(s): Debian GNU/Linux 7.0
Debian GNU/kFreeBSD 7.0
Product(s): file
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:26755
 
Oval ID: oval:org.mitre.oval:def:26755
Title: USN-2344-1 -- php5 vulnerabilities
Description: php5 could be made to crash or run programs if it received specially crafted network traffic.
Family: unix Class: patch
Reference(s): USN-2344-1
CVE-2014-3587
CVE-2014-3597
Version: 3
Platform(s): Ubuntu 14.04
Ubuntu 12.04
Ubuntu 10.04
Product(s): php5
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:26896
 
Oval ID: oval:org.mitre.oval:def:26896
Title: SUSE-SU-2014:1141-1 -- Security update for php53
Description: This php53 update fixes the following security issues: * Insecure temporary file used for cache data was fixed by switching to a different root only directory /var/cache/php-pear. (CVE-2014-5459) * An incomplete fix for CVE-2014-4049. (CVE-2014-3597) Security Issues: * CVE-2014-5459 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5459> * CVE-2014-4049 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4049>
Family: unix Class: patch
Reference(s): SUSE-SU-2014:1141-1
CVE-2014-5459
CVE-2014-4049
CVE-2014-3597
Version: 3
Platform(s): SUSE Linux Enterprise Server 11
Product(s): php53
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:27096
 
Oval ID: oval:org.mitre.oval:def:27096
Title: USN-2369-1 -- file vulnerability
Description: file could be made to crash or run programs as your login if it opened a specially crafted file.
Family: unix Class: patch
Reference(s): USN-2369-1
CVE-2014-3587
Version: 3
Platform(s): Ubuntu 14.04
Ubuntu 12.04
Ubuntu 10.04
Product(s): file
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:27986
 
Oval ID: oval:org.mitre.oval:def:27986
Title: DSA-3021-2 -- file regression update
Description: Multiple security issues have been found in file, a tool to determine a file type. These vulnerabilities allow remote attackers to cause a denial of service, via resource consumption or application crash.
Family: unix Class: patch
Reference(s): DSA-3021-2
CVE-2014-0207
CVE-2014-0237
CVE-2014-0238
CVE-2014-3478
CVE-2014-3479
CVE-2014-3480
CVE-2014-3487
CVE-2014-3538
CVE-2014-3587
Version: 3
Platform(s): Debian GNU/Linux 7.0
Debian GNU/kFreeBSD 7.0
Product(s): file
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 53
Application 527

Snort® IPS/IDS

Date Description
2016-03-14 PHP fileinfo cdf_read_property_info denial of service attempt
RuleID : 36262 - Revision : 3 - Type : SERVER-WEBAPP
2016-03-14 PHP fileinfo cdf_read_property_info denial of service attempt
RuleID : 36261 - Revision : 3 - Type : SERVER-WEBAPP

Nessus® Vulnerability Scanner

Date Description
2016-10-05 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2016-1156.nasl - Type : ACT_GATHER_INFO
2016-09-19 Name : The remote SUSE host is missing one or more security updates.
File : suse_SU-2016-2328-1.nasl - Type : ACT_GATHER_INFO
2016-09-08 Name : The remote SUSE host is missing one or more security updates.
File : suse_SU-2016-2210-1.nasl - Type : ACT_GATHER_INFO
2016-08-29 Name : The remote SUSE host is missing one or more security updates.
File : suse_SU-2016-1638-1.nasl - Type : ACT_GATHER_INFO
2016-06-09 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20160510_file_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2016-05-17 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2016-0760.nasl - Type : ACT_GATHER_INFO
2016-05-16 Name : The remote OracleVM host is missing one or more security updates.
File : oraclevm_OVMSA-2016-0050.nasl - Type : ACT_GATHER_INFO
2016-05-16 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2016-0760.nasl - Type : ACT_GATHER_INFO
2016-05-12 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2016-0760.nasl - Type : ACT_GATHER_INFO
2015-12-22 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20151119_file_on_SL7_x.nasl - Type : ACT_GATHER_INFO
2015-12-02 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2015-2155.nasl - Type : ACT_GATHER_INFO
2015-11-24 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2015-2155.nasl - Type : ACT_GATHER_INFO
2015-11-20 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2015-2155.nasl - Type : ACT_GATHER_INFO
2015-04-10 Name : The remote host is missing a Mac OS X update that fixes multiple security vul...
File : macosx_SecUpd2015-004.nasl - Type : ACT_GATHER_INFO
2015-04-10 Name : The remote host is missing a Mac OS X update that fixes multiple security vul...
File : macosx_10_10_3.nasl - Type : ACT_GATHER_INFO
2015-03-30 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2015-080.nasl - Type : ACT_GATHER_INFO
2015-03-26 Name : The remote Debian host is missing a security update.
File : debian_DLA-50.nasl - Type : ACT_GATHER_INFO
2015-03-26 Name : The remote Debian host is missing a security update.
File : debian_DLA-67.nasl - Type : ACT_GATHER_INFO
2014-10-12 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2014-415.nasl - Type : ACT_GATHER_INFO
2014-10-12 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2014-398.nasl - Type : ACT_GATHER_INFO
2014-10-03 Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-2369-1.nasl - Type : ACT_GATHER_INFO
2014-10-01 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2014-1327.nasl - Type : ACT_GATHER_INFO
2014-10-01 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2014-1327.nasl - Type : ACT_GATHER_INFO
2014-10-01 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2014-1326.nasl - Type : ACT_GATHER_INFO
2014-10-01 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2014-1327.nasl - Type : ACT_GATHER_INFO
2014-10-01 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2014-1326.nasl - Type : ACT_GATHER_INFO
2014-09-30 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2014-1326.nasl - Type : ACT_GATHER_INFO
2014-09-17 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2014-546.nasl - Type : ACT_GATHER_INFO
2014-09-12 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2014-172.nasl - Type : ACT_GATHER_INFO
2014-09-12 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2014-167.nasl - Type : ACT_GATHER_INFO
2014-09-10 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-2344-1.nasl - Type : ACT_GATHER_INFO
2014-09-10 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-3021.nasl - Type : ACT_GATHER_INFO
2014-09-03 Name : The remote Fedora host is missing a security update.
File : fedora_2014-9684.nasl - Type : ACT_GATHER_INFO
2014-09-03 Name : The remote Fedora host is missing a security update.
File : fedora_2014-9679.nasl - Type : ACT_GATHER_INFO
2014-08-30 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201408-11.nasl - Type : ACT_GATHER_INFO
2014-08-22 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-3008.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
1
Date Informations
2014-09-11 13:25:50
  • Multiple Updates
2014-09-10 05:26:49
  • First insertion