Executive Summary
| Summary | |
|---|---|
| Title | php security update |
| Informations | |||
|---|---|---|---|
| Name | RHSA-2006:0568 | First vendor Publication | 2006-07-12 |
| Vendor | RedHat | Last vendor Modification | 2006-07-12 |
| Severity (Vendor) | Moderate | Revision | 01 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 9.3 | Attack Range | Network |
| Cvss Impact Score | 10 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Problem Description: Updated PHP packages that fix multiple security issues are now available for Red Hat Enterprise Linux 3 and 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Desktop version 3 - i386, x86_64 Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 3. Problem description: PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server. A directory traversal vulnerability was found in PHP. Local users could bypass open_basedir restrictions allowing remote attackers to create files in arbitrary directories via the tempnam() function. (CVE-2006-1494) The wordwrap() PHP function did not properly check for integer overflow in the handling of the "break" parameter. An attacker who could control the string passed to the "break" parameter could cause a heap overflow. (CVE-2006-1990) A flaw was found in the zend_hash_del() PHP function. For PHP scripts that rely on the use of the unset() function, a remote attacker could force variable initialization to be bypassed. This would be a security issue particularly for installations that enable the "register_globals" setting. "register_globals" is disabled by default in Red Hat Enterprise Linux. (CVE-2006-3017) Users of PHP should upgrade to these updated packages, which contain backported patches that resolve these issues. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via Red Hat Network. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. 5. Bug IDs fixed (http://bugzilla.redhat.com/): 189591 - CVE-2006-1494 PHP tempname open_basedir issue 190033 - CVE-2006-1990 wordwrap integer overflow 196256 - CVE-2006-3017 zend_hash_del bug |
Original Source
| Url : https://rhn.redhat.com/errata/RHSA-2006-0568.html |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:10118 | |||
| Oval ID: | oval:org.mitre.oval:def:10118 | ||
| Title: | zend_hash_del_key_or_index in zend_hash.c in PHP before 4.4.3 and 5.x before 5.1.3 can cause zend_hash_del to delete the wrong element, which prevents a variable from being unset even when the PHP unset function is called, which might cause the variable's value to be used in security-relevant operations. | ||
| Description: | zend_hash_del_key_or_index in zend_hash.c in PHP before 4.4.3 and 5.x before 5.1.3 can cause zend_hash_del to delete the wrong element, which prevents a variable from being unset even when the PHP unset function is called, which might cause the variable's value to be used in security-relevant operations. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2006-3017 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:9696 | |||
| Oval ID: | oval:org.mitre.oval:def:9696 | ||
| Title: | Integer overflow in the wordwrap function in string.c in PHP 4.4.2 and 5.1.2 might allow context-dependent attackers to execute arbitrary code via certain long arguments that cause a small buffer to be allocated, which triggers a heap-based buffer overflow in a memcpy function call, a different vulnerability than CVE-2002-1396. | ||
| Description: | Integer overflow in the wordwrap function in string.c in PHP 4.4.2 and 5.1.2 might allow context-dependent attackers to execute arbitrary code via certain long arguments that cause a small buffer to be allocated, which triggers a heap-based buffer overflow in a memcpy function call, a different vulnerability than CVE-2002-1396. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2006-1990 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-11-17 | Name : Mac OS X Version File : nvt/macosx_version.nasl |
| 2008-09-24 | Name : Gentoo Security Advisory GLSA 200605-08 (php) File : nvt/glsa_200605_08.nasl |
| 2008-01-17 | Name : Debian Security Advisory DSA 1206-1 (php4) File : nvt/deb_1206_1.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 26466 | PHP zend_hash_del() Variable Unsetting Unspecified Issue PHP contains a flaw related to the zend_hash_del() variable that may allow an attacker to compromise a vulnerable system. No further details have been provided. |
| 25255 | PHP unset() Function Variable Persistence PHP contains a flaw where variables will not have their data removed even after having been unset(). No further details have been provided. |
| 24944 | PHP wordwrap() Function Overflow PHP contains a flaw that may allow a context-dependent attacker to gain elevated privileges. The issue is due the wordwrap function in string.c not properly sanitizing user-supplied input. By passing a crafted string an attacker could trigger a heap-based buffer overflow and execute arbitrary code. |
| 24486 | PHP tempnam() Function open_basedir Restriction Bypass PHP contains a flaw that may allow malicious users to bypass security restrictions. The issue is due to file.c not properly sanitizing user-supplied input. This may allow an attacker to bypass the open_basedir restriction, traverse the file system and access arbitrary files. Additionally, a remote attacker may be able to create files in arbitrary directories via the tempnam() function. |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2007-11-10 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-320-1.nasl - Type : ACT_GATHER_INFO |
| 2007-10-17 | Name : The remote openSUSE host is missing a security update. File : suse_php5-1590.nasl - Type : ACT_GATHER_INFO |
| 2007-02-18 | Name : The remote host is missing a vendor-supplied security patch File : suse_SA_2006_031.nasl - Type : ACT_GATHER_INFO |
| 2007-02-18 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2006-196.nasl - Type : ACT_GATHER_INFO |
| 2006-11-20 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1206.nasl - Type : ACT_GATHER_INFO |
| 2006-09-06 | Name : The remote web server contains a PHP script that is affected by a global vari... File : pmwiki_globals_overwrite.nasl - Type : ACT_ATTACK |
| 2006-09-02 | Name : The remote web server contains a PHP script that allows execution of arbitrar... File : e107_globals_overwrite.nasl - Type : ACT_ATTACK |
| 2006-08-25 | Name : The remote web server uses a version of PHP that is affected by multiple flaws. File : php_4_4_3.nasl - Type : ACT_GATHER_INFO |
| 2006-07-28 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2006-0567.nasl - Type : ACT_GATHER_INFO |
| 2006-07-17 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2006-122.nasl - Type : ACT_GATHER_INFO |
| 2006-07-13 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2006-0568.nasl - Type : ACT_GATHER_INFO |
| 2006-07-13 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2006-0568.nasl - Type : ACT_GATHER_INFO |
| 2006-05-27 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2006-091.nasl - Type : ACT_GATHER_INFO |
| 2006-05-24 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2006-0501.nasl - Type : ACT_GATHER_INFO |
| 2006-05-13 | Name : The remote host is missing a vendor-supplied security patch File : suse_SA_2006_024.nasl - Type : ACT_GATHER_INFO |
| 2006-05-13 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200605-08.nasl - Type : ACT_GATHER_INFO |
| 2006-04-26 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2006-074.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:50:05 |
|
