Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Summary
Title php security update
Informations
Name RHSA-2006:0669 First vendor Publication 2006-09-21
Vendor RedHat Last vendor Modification 2006-09-21
Severity (Vendor) Moderate Revision 01

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Cvss Base Score 9.3 Attack Range Network
Cvss Impact Score 10 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Problem Description:

Updated PHP packages that fix multiple security issues are now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Desktop version 3 - i386, x86_64 Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64

3. Problem description:

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server.

A response-splitting issue was discovered in the PHP session handling. If a remote attacker can force a carefully crafted session identifier to be used, a cross-site-scripting or response-splitting attack could be possible. (CVE-2006-3016)

A buffer overflow was discovered in the PHP sscanf() function. If a script used the sscanf() function with positional arguments in the format string, a remote attacker sending a carefully crafted request could execute arbitrary code as the 'apache' user. (CVE-2006-4020)

An integer overflow was discovered in the PHP wordwrap() and str_repeat() functions. If a script running on a 64-bit server used either of these functions on untrusted user data, a remote attacker sending a carefully crafted request might be able to cause a heap overflow. (CVE-2006-4482)

A buffer overflow was discovered in the PHP gd extension. If a script was set up to process GIF images from untrusted sources using the gd extension, a remote attacker could cause a heap overflow. (CVE-2006-4484)

An integer overflow was discovered in the PHP memory allocation handling. On 64-bit platforms, the "memory_limit" setting was not enforced correctly, which could allow a denial of service attack by a remote user. (CVE-2006-4486)

Users of PHP should upgrade to these updated packages which contain backported patches to correct these issues. These packages also contain a fix for a bug where certain input strings to the metaphone() function could cause memory corruption.

4. Solution:

Before applying this update, make sure all previously released errata relevant to your system have been applied.

This update is available via Red Hat Network. To use Red Hat Network, launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate RPMs being upgraded on your system.

5. Bug IDs fixed (http://bugzilla.redhat.com/):

201766 - CVE-2006-4020 PHP buffer overread flaw 204993 - CVE-2006-4482 PHP heap overflow 205714 - metaphone() function causing Apache segfaults 206664 - CVE-2006-4486 PHP integer overflows in Zend 206956 - CVE-2006-4484 PHP heap overflow in LWZReadByte 206959 - CVE-2006-3016 PHP session ID validation

Original Source

Url : https://rhn.redhat.com/errata/RHSA-2006-0669.html

CWE : Common Weakness Enumeration

% Id Name
50 % CWE-189 Numeric Errors (CWE/SANS Top 25)
50 % CWE-119 Failure to Constrain Operations within the Bounds of a Memory Buffer

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:10121
 
Oval ID: oval:org.mitre.oval:def:10121
Title: Multiple heap-based buffer overflows in the (1) str_repeat and (2) wordwrap functions in ext/standard/string.c in PHP before 5.1.5, when used on a 64-bit system, have unspecified impact and attack vectors, a different vulnerability than CVE-2006-1990.
Description: Multiple heap-based buffer overflows in the (1) str_repeat and (2) wordwrap functions in ext/standard/string.c in PHP before 5.1.5, when used on a 64-bit system, have unspecified impact and attack vectors, a different vulnerability than CVE-2006-1990.
Family: unix Class: vulnerability
Reference(s): CVE-2006-4482
Version: 5
Platform(s): Red Hat Enterprise Linux 3
CentOS Linux 3
Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:10597
 
Oval ID: oval:org.mitre.oval:def:10597
Title: Unspecified vulnerability in session.c in PHP before 5.1.3 has unknown impact and attack vectors, related to "certain characters in session names," including special characters that are frequently associated with CRLF injection, SQL injection, cross-site scripting (XSS), and HTTP response splitting vulnerabilities. NOTE: while the nature of the vulnerability is unspecified, it is likely that this is related to a violation of an expectation by PHP applications that the session name is alphanumeric, as implied in the PHP manual for session_name().
Description: Unspecified vulnerability in session.c in PHP before 5.1.3 has unknown impact and attack vectors, related to "certain characters in session names," including special characters that are frequently associated with CRLF injection, SQL injection, cross-site scripting (XSS), and HTTP response splitting vulnerabilities. NOTE: while the nature of the vulnerability is unspecified, it is likely that this is related to a violation of an expectation by PHP applications that the session name is alphanumeric, as implied in the PHP manual for session_name().
Family: unix Class: vulnerability
Reference(s): CVE-2006-3016
Version: 5
Platform(s): Red Hat Enterprise Linux 3
CentOS Linux 3
Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:11062
 
Oval ID: oval:org.mitre.oval:def:11062
Title: scanf.c in PHP 5.1.4 and earlier, and 4.4.3 and earlier, allows context-dependent attackers to execute arbitrary code via a sscanf PHP function call that performs argument swapping, which increments an index past the end of an array and triggers a buffer over-read.
Description: scanf.c in PHP 5.1.4 and earlier, and 4.4.3 and earlier, allows context-dependent attackers to execute arbitrary code via a sscanf PHP function call that performs argument swapping, which increments an index past the end of an array and triggers a buffer over-read.
Family: unix Class: vulnerability
Reference(s): CVE-2006-4020
Version: 5
Platform(s): Red Hat Enterprise Linux 3
CentOS Linux 3
Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:11086
 
Oval ID: oval:org.mitre.oval:def:11086
Title: Integer overflow in memory allocation routines in PHP before 5.1.6, when running on a 64-bit system, allows context-dependent attackers to bypass the memory_limit restriction.
Description: Integer overflow in memory allocation routines in PHP before 5.1.6, when running on a 64-bit system, allows context-dependent attackers to bypass the memory_limit restriction.
Family: unix Class: vulnerability
Reference(s): CVE-2006-4486
Version: 5
Platform(s): Red Hat Enterprise Linux 3
CentOS Linux 3
Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:9004
 
Oval ID: oval:org.mitre.oval:def:9004
Title: Buffer overflow in the LWZReadByte_ function in ext/gd/libgd/gd_gif_in.c in the GD extension in PHP before 5.1.5 allows remote attackers to have an unknown impact via a GIF file with input_code_size greater than MAX_LWZ_BITS, which triggers an overflow when initializing the table array.
Description: Buffer overflow in the LWZReadByte_ function in ext/gd/libgd/gd_gif_in.c in the GD extension in PHP before 5.1.5 allows remote attackers to have an unknown impact via a GIF file with input_code_size greater than MAX_LWZ_BITS, which triggers an overflow when initializing the table array.
Family: unix Class: vulnerability
Reference(s): CVE-2006-4484
Version: 5
Platform(s): Red Hat Enterprise Linux 3
CentOS Linux 3
Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
Product(s):
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 67
Application 2

OpenVAS Exploits

Date Description
2012-06-21 Name : PHP version smaller than 5.2.0
File : nvt/nopsec_php_5_2_0.nasl
2012-06-21 Name : PHP 5.1.x < 5.1.5
File : nvt/nopsec_php_5_1_5.nasl
2012-06-21 Name : PHP version smaller than 4.4.4
File : nvt/nopsec_php_4_4_4.nasl
2009-10-13 Name : SLES10: Security update for perl-Tk
File : nvt/sles10_perl-Tk.nasl
2009-10-10 Name : SLES9: Security update for perl-Tk
File : nvt/sles9p5021923.nasl
2009-10-10 Name : SLES9: Security update for PHP4
File : nvt/sles9p5015565.nasl
2009-04-09 Name : Mandriva Update for gd MDVSA-2008:038 (gd)
File : nvt/gb_mandriva_MDVSA_2008_038.nasl
2009-04-09 Name : Mandriva Update for perl-Tk MDVSA-2008:077 (perl-Tk)
File : nvt/gb_mandriva_MDVSA_2008_077.nasl
2009-03-06 Name : RedHat Update for gd RHSA-2008:0146-01
File : nvt/gb_RHSA-2008_0146-01_gd.nasl
2009-02-27 Name : CentOS Update for gd CESA-2008:0146 centos4 i386
File : nvt/gb_CESA-2008_0146_gd_centos4_i386.nasl
2009-02-27 Name : CentOS Update for gd CESA-2008:0146 centos4 x86_64
File : nvt/gb_CESA-2008_0146_gd_centos4_x86_64.nasl
2009-02-16 Name : Fedora Update for graphviz FEDORA-2008-1643
File : nvt/gb_fedora_2008_1643_graphviz_fc7.nasl
2009-02-13 Name : Fedora Update for tk FEDORA-2008-1131
File : nvt/gb_fedora_2008_1131_tk_fc7.nasl
2009-02-13 Name : Fedora Update for tk FEDORA-2008-1122
File : nvt/gb_fedora_2008_1122_tk_fc8.nasl
2008-09-24 Name : Gentoo Security Advisory GLSA 200608-28 (php)
File : nvt/glsa_200608_28.nasl
2008-09-04 Name : FreeBSD Ports: sdl_image
File : nvt/freebsd_sdl_image.nasl
2008-09-04 Name : FreeBSD Ports: php4, php5
File : nvt/freebsd_php40.nasl
2008-01-17 Name : Debian Security Advisory DSA 1206-1 (php4)
File : nvt/deb_1206_1.nasl
2008-01-17 Name : Debian Security Advisory DSA 1331-1 (php4)
File : nvt/deb_1331_1.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
28004 PHP on 64-bit wordwrap() Function Overflow

28003 PHP on 64-bit str_repeat() Function Overflow

28002 PHP GD Extension GIF Processing Overflow

28001 PHP on 64-bit memory_limit Unspecified Issue

27824 PHP sscanf() Function Argument Swapping Overflow

PHP contains a flaw that may allow a context-dependent attacker to elevate privileges. The issue is due to the sscanf function in scanf.c not properly sanitizing user-supplied input. Passing a crafted string to this function may trigger a buvver over-read allowing the execution of arbitrary code.
25253 PHP Session Name Unspecified Character Weakness

PHP contains a flaw related to the use of unspecified unusual characters in session names. No further details have been provided.

Nessus® Vulnerability Scanner

Date Description
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2008-0146.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing a security update.
File : oraclelinux_ELSA-2006-0730.nasl - Type : ACT_GATHER_INFO
2012-08-01 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20080228_gd_on_SL4_x.nasl - Type : ACT_GATHER_INFO
2011-11-18 Name : The remote web server uses a version of PHP that is affected by multiple vuln...
File : php_5_1_5.nasl - Type : ACT_GATHER_INFO
2011-11-18 Name : The remote web server uses a version of PHP that is affected by multiple vuln...
File : php_4_4_4.nasl - Type : ACT_GATHER_INFO
2009-09-24 Name : The remote SuSE 9 host is missing a security-related patch.
File : suse9_12093.nasl - Type : ACT_GATHER_INFO
2009-04-23 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2008-038.nasl - Type : ACT_GATHER_INFO
2009-04-23 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2008-077.nasl - Type : ACT_GATHER_INFO
2008-06-09 Name : The remote openSUSE host is missing a security update.
File : suse_tkimg-5328.nasl - Type : ACT_GATHER_INFO
2008-06-09 Name : The remote openSUSE host is missing a security update.
File : suse_tkimg-5320.nasl - Type : ACT_GATHER_INFO
2008-03-25 Name : The remote web server uses a version of PHP that is affected by multiple buff...
File : php_5_2_0.nasl - Type : ACT_GATHER_INFO
2008-03-04 Name : The remote openSUSE host is missing a security update.
File : suse_perl-Tk-5035.nasl - Type : ACT_GATHER_INFO
2008-03-04 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_perl-Tk-5034.nasl - Type : ACT_GATHER_INFO
2008-02-29 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2008-0146.nasl - Type : ACT_GATHER_INFO
2008-02-28 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2008-0146.nasl - Type : ACT_GATHER_INFO
2008-02-14 Name : The remote Fedora host is missing a security update.
File : fedora_2008-1643.nasl - Type : ACT_GATHER_INFO
2008-02-11 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200802-01.nasl - Type : ACT_GATHER_INFO
2008-02-01 Name : The remote openSUSE host is missing a security update.
File : suse_SDL_image-4956.nasl - Type : ACT_GATHER_INFO
2007-12-13 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_apache2-mod_php5-2102.nasl - Type : ACT_GATHER_INFO
2007-11-10 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-362-1.nasl - Type : ACT_GATHER_INFO
2007-11-10 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-342-1.nasl - Type : ACT_GATHER_INFO
2007-11-10 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-320-1.nasl - Type : ACT_GATHER_INFO
2007-10-17 Name : The remote openSUSE host is missing a security update.
File : suse_apache2-mod_php5-2039.nasl - Type : ACT_GATHER_INFO
2007-07-10 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1331.nasl - Type : ACT_GATHER_INFO
2007-02-18 Name : The remote host is missing a vendor-supplied security patch
File : suse_SA_2006_052.nasl - Type : ACT_GATHER_INFO
2007-01-17 Name : The remote Fedora Core host is missing a security update.
File : fedora_2006-1024.nasl - Type : ACT_GATHER_INFO
2006-12-16 Name : The remote Mandrake Linux host is missing one or more security updates.
File : mandrake_MDKSA-2006-162.nasl - Type : ACT_GATHER_INFO
2006-12-16 Name : The remote Mandrake Linux host is missing one or more security updates.
File : mandrake_MDKSA-2006-144.nasl - Type : ACT_GATHER_INFO
2006-11-20 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1206.nasl - Type : ACT_GATHER_INFO
2006-09-22 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2006-0682.nasl - Type : ACT_GATHER_INFO
2006-09-22 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2006-0669.nasl - Type : ACT_GATHER_INFO
2006-09-22 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2006-0669.nasl - Type : ACT_GATHER_INFO
2006-09-14 Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_ea09c5df436211db81e1000e0c2e438a.nasl - Type : ACT_GATHER_INFO
2006-08-30 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200608-28.nasl - Type : ACT_GATHER_INFO
2006-08-25 Name : The remote web server uses a version of PHP that is affected by multiple flaws.
File : php_4_4_3.nasl - Type : ACT_GATHER_INFO
2006-07-17 Name : The remote Mandrake Linux host is missing one or more security updates.
File : mandrake_MDKSA-2006-122.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
1
Date Informations
2014-02-17 11:50:13
  • Multiple Updates
2013-05-11 12:23:37
  • Multiple Updates