Executive Summary
Summary | |
---|---|
Title | php security update |
Informations | |||
---|---|---|---|
Name | RHSA-2006:0669 | First vendor Publication | 2006-09-21 |
Vendor | RedHat | Last vendor Modification | 2006-09-21 |
Severity (Vendor) | Moderate | Revision | 01 |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C) | |||
---|---|---|---|
Cvss Base Score | 9.3 | Attack Range | Network |
Cvss Impact Score | 10 | Attack Complexity | Medium |
Cvss Expoit Score | 8.6 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
Problem Description: Updated PHP packages that fix multiple security issues are now available for Red Hat Enterprise Linux 3 and 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Desktop version 3 - i386, x86_64 Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 3. Problem description: PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server. A response-splitting issue was discovered in the PHP session handling. If a remote attacker can force a carefully crafted session identifier to be used, a cross-site-scripting or response-splitting attack could be possible. (CVE-2006-3016) A buffer overflow was discovered in the PHP sscanf() function. If a script used the sscanf() function with positional arguments in the format string, a remote attacker sending a carefully crafted request could execute arbitrary code as the 'apache' user. (CVE-2006-4020) An integer overflow was discovered in the PHP wordwrap() and str_repeat() functions. If a script running on a 64-bit server used either of these functions on untrusted user data, a remote attacker sending a carefully crafted request might be able to cause a heap overflow. (CVE-2006-4482) A buffer overflow was discovered in the PHP gd extension. If a script was set up to process GIF images from untrusted sources using the gd extension, a remote attacker could cause a heap overflow. (CVE-2006-4484) An integer overflow was discovered in the PHP memory allocation handling. On 64-bit platforms, the "memory_limit" setting was not enforced correctly, which could allow a denial of service attack by a remote user. (CVE-2006-4486) Users of PHP should upgrade to these updated packages which contain backported patches to correct these issues. These packages also contain a fix for a bug where certain input strings to the metaphone() function could cause memory corruption. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via Red Hat Network. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. 5. Bug IDs fixed (http://bugzilla.redhat.com/): 201766 - CVE-2006-4020 PHP buffer overread flaw 204993 - CVE-2006-4482 PHP heap overflow 205714 - metaphone() function causing Apache segfaults 206664 - CVE-2006-4486 PHP integer overflows in Zend 206956 - CVE-2006-4484 PHP heap overflow in LWZReadByte 206959 - CVE-2006-3016 PHP session ID validation |
Original Source
Url : https://rhn.redhat.com/errata/RHSA-2006-0669.html |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
50 % | CWE-787 | Out-of-bounds Write (CWE/SANS Top 25) |
50 % | CWE-189 | Numeric Errors (CWE/SANS Top 25) |
OVAL Definitions
Definition Id: oval:org.mitre.oval:def:10121 | |||
Oval ID: | oval:org.mitre.oval:def:10121 | ||
Title: | Multiple heap-based buffer overflows in the (1) str_repeat and (2) wordwrap functions in ext/standard/string.c in PHP before 5.1.5, when used on a 64-bit system, have unspecified impact and attack vectors, a different vulnerability than CVE-2006-1990. | ||
Description: | Multiple heap-based buffer overflows in the (1) str_repeat and (2) wordwrap functions in ext/standard/string.c in PHP before 5.1.5, when used on a 64-bit system, have unspecified impact and attack vectors, a different vulnerability than CVE-2006-1990. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2006-4482 | Version: | 5 |
Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:10597 | |||
Oval ID: | oval:org.mitre.oval:def:10597 | ||
Title: | Unspecified vulnerability in session.c in PHP before 5.1.3 has unknown impact and attack vectors, related to "certain characters in session names," including special characters that are frequently associated with CRLF injection, SQL injection, cross-site scripting (XSS), and HTTP response splitting vulnerabilities. NOTE: while the nature of the vulnerability is unspecified, it is likely that this is related to a violation of an expectation by PHP applications that the session name is alphanumeric, as implied in the PHP manual for session_name(). | ||
Description: | Unspecified vulnerability in session.c in PHP before 5.1.3 has unknown impact and attack vectors, related to "certain characters in session names," including special characters that are frequently associated with CRLF injection, SQL injection, cross-site scripting (XSS), and HTTP response splitting vulnerabilities. NOTE: while the nature of the vulnerability is unspecified, it is likely that this is related to a violation of an expectation by PHP applications that the session name is alphanumeric, as implied in the PHP manual for session_name(). | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2006-3016 | Version: | 5 |
Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:11062 | |||
Oval ID: | oval:org.mitre.oval:def:11062 | ||
Title: | scanf.c in PHP 5.1.4 and earlier, and 4.4.3 and earlier, allows context-dependent attackers to execute arbitrary code via a sscanf PHP function call that performs argument swapping, which increments an index past the end of an array and triggers a buffer over-read. | ||
Description: | scanf.c in PHP 5.1.4 and earlier, and 4.4.3 and earlier, allows context-dependent attackers to execute arbitrary code via a sscanf PHP function call that performs argument swapping, which increments an index past the end of an array and triggers a buffer over-read. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2006-4020 | Version: | 5 |
Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:9004 | |||
Oval ID: | oval:org.mitre.oval:def:9004 | ||
Title: | Buffer overflow in the LWZReadByte_ function in ext/gd/libgd/gd_gif_in.c in the GD extension in PHP before 5.1.5 allows remote attackers to have an unknown impact via a GIF file with input_code_size greater than MAX_LWZ_BITS, which triggers an overflow when initializing the table array. | ||
Description: | Buffer overflow in the LWZReadByte_ function in ext/gd/libgd/gd_gif_in.c in the GD extension in PHP before 5.1.5 allows remote attackers to have an unknown impact via a GIF file with input_code_size greater than MAX_LWZ_BITS, which triggers an overflow when initializing the table array. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2006-4484 | Version: | 5 |
Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
Definition Synopsis: | |||
|
CPE : Common Platform Enumeration
OpenVAS Exploits
Date | Description |
---|---|
2012-06-21 | Name : PHP version smaller than 5.2.0 File : nvt/nopsec_php_5_2_0.nasl |
2012-06-21 | Name : PHP 5.1.x < 5.1.5 File : nvt/nopsec_php_5_1_5.nasl |
2012-06-21 | Name : PHP version smaller than 4.4.4 File : nvt/nopsec_php_4_4_4.nasl |
2009-10-13 | Name : SLES10: Security update for perl-Tk File : nvt/sles10_perl-Tk.nasl |
2009-10-10 | Name : SLES9: Security update for perl-Tk File : nvt/sles9p5021923.nasl |
2009-10-10 | Name : SLES9: Security update for PHP4 File : nvt/sles9p5015565.nasl |
2009-04-09 | Name : Mandriva Update for gd MDVSA-2008:038 (gd) File : nvt/gb_mandriva_MDVSA_2008_038.nasl |
2009-04-09 | Name : Mandriva Update for perl-Tk MDVSA-2008:077 (perl-Tk) File : nvt/gb_mandriva_MDVSA_2008_077.nasl |
2009-03-06 | Name : RedHat Update for gd RHSA-2008:0146-01 File : nvt/gb_RHSA-2008_0146-01_gd.nasl |
2009-02-27 | Name : CentOS Update for gd CESA-2008:0146 centos4 i386 File : nvt/gb_CESA-2008_0146_gd_centos4_i386.nasl |
2009-02-27 | Name : CentOS Update for gd CESA-2008:0146 centos4 x86_64 File : nvt/gb_CESA-2008_0146_gd_centos4_x86_64.nasl |
2009-02-16 | Name : Fedora Update for graphviz FEDORA-2008-1643 File : nvt/gb_fedora_2008_1643_graphviz_fc7.nasl |
2009-02-13 | Name : Fedora Update for tk FEDORA-2008-1131 File : nvt/gb_fedora_2008_1131_tk_fc7.nasl |
2009-02-13 | Name : Fedora Update for tk FEDORA-2008-1122 File : nvt/gb_fedora_2008_1122_tk_fc8.nasl |
2008-09-24 | Name : Gentoo Security Advisory GLSA 200608-28 (php) File : nvt/glsa_200608_28.nasl |
2008-09-04 | Name : FreeBSD Ports: sdl_image File : nvt/freebsd_sdl_image.nasl |
2008-09-04 | Name : FreeBSD Ports: php4, php5 File : nvt/freebsd_php40.nasl |
2008-01-17 | Name : Debian Security Advisory DSA 1206-1 (php4) File : nvt/deb_1206_1.nasl |
2008-01-17 | Name : Debian Security Advisory DSA 1331-1 (php4) File : nvt/deb_1331_1.nasl |
Open Source Vulnerability Database (OSVDB)
Id | Description |
---|---|
28004 | PHP on 64-bit wordwrap() Function Overflow |
28003 | PHP on 64-bit str_repeat() Function Overflow |
28002 | PHP GD Extension GIF Processing Overflow |
28001 | PHP on 64-bit memory_limit Unspecified Issue |
27824 | PHP sscanf() Function Argument Swapping Overflow PHP contains a flaw that may allow a context-dependent attacker to elevate privileges. The issue is due to the sscanf function in scanf.c not properly sanitizing user-supplied input. Passing a crafted string to this function may trigger a buvver over-read allowing the execution of arbitrary code. |
25253 | PHP Session Name Unspecified Character Weakness PHP contains a flaw related to the use of unspecified unusual characters in session names. No further details have been provided. |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2008-0146.nasl - Type : ACT_GATHER_INFO |
2013-07-12 | Name : The remote Oracle Linux host is missing a security update. File : oraclelinux_ELSA-2006-0730.nasl - Type : ACT_GATHER_INFO |
2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20080228_gd_on_SL4_x.nasl - Type : ACT_GATHER_INFO |
2011-11-18 | Name : The remote web server uses a version of PHP that is affected by multiple vuln... File : php_5_1_5.nasl - Type : ACT_GATHER_INFO |
2011-11-18 | Name : The remote web server uses a version of PHP that is affected by multiple vuln... File : php_4_4_4.nasl - Type : ACT_GATHER_INFO |
2009-09-24 | Name : The remote SuSE 9 host is missing a security-related patch. File : suse9_12093.nasl - Type : ACT_GATHER_INFO |
2009-04-23 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2008-038.nasl - Type : ACT_GATHER_INFO |
2009-04-23 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2008-077.nasl - Type : ACT_GATHER_INFO |
2008-06-09 | Name : The remote openSUSE host is missing a security update. File : suse_tkimg-5328.nasl - Type : ACT_GATHER_INFO |
2008-06-09 | Name : The remote openSUSE host is missing a security update. File : suse_tkimg-5320.nasl - Type : ACT_GATHER_INFO |
2008-03-25 | Name : The remote web server uses a version of PHP that is affected by multiple buff... File : php_5_2_0.nasl - Type : ACT_GATHER_INFO |
2008-03-04 | Name : The remote openSUSE host is missing a security update. File : suse_perl-Tk-5035.nasl - Type : ACT_GATHER_INFO |
2008-03-04 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_perl-Tk-5034.nasl - Type : ACT_GATHER_INFO |
2008-02-29 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2008-0146.nasl - Type : ACT_GATHER_INFO |
2008-02-28 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2008-0146.nasl - Type : ACT_GATHER_INFO |
2008-02-14 | Name : The remote Fedora host is missing a security update. File : fedora_2008-1643.nasl - Type : ACT_GATHER_INFO |
2008-02-11 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200802-01.nasl - Type : ACT_GATHER_INFO |
2008-02-01 | Name : The remote openSUSE host is missing a security update. File : suse_SDL_image-4956.nasl - Type : ACT_GATHER_INFO |
2007-12-13 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_apache2-mod_php5-2102.nasl - Type : ACT_GATHER_INFO |
2007-11-10 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-362-1.nasl - Type : ACT_GATHER_INFO |
2007-11-10 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-342-1.nasl - Type : ACT_GATHER_INFO |
2007-11-10 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-320-1.nasl - Type : ACT_GATHER_INFO |
2007-10-17 | Name : The remote openSUSE host is missing a security update. File : suse_apache2-mod_php5-2039.nasl - Type : ACT_GATHER_INFO |
2007-07-10 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1331.nasl - Type : ACT_GATHER_INFO |
2007-02-18 | Name : The remote host is missing a vendor-supplied security patch File : suse_SA_2006_052.nasl - Type : ACT_GATHER_INFO |
2007-01-17 | Name : The remote Fedora Core host is missing a security update. File : fedora_2006-1024.nasl - Type : ACT_GATHER_INFO |
2006-12-16 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2006-162.nasl - Type : ACT_GATHER_INFO |
2006-12-16 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2006-144.nasl - Type : ACT_GATHER_INFO |
2006-11-20 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1206.nasl - Type : ACT_GATHER_INFO |
2006-09-22 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2006-0682.nasl - Type : ACT_GATHER_INFO |
2006-09-22 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2006-0669.nasl - Type : ACT_GATHER_INFO |
2006-09-22 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2006-0669.nasl - Type : ACT_GATHER_INFO |
2006-09-14 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_ea09c5df436211db81e1000e0c2e438a.nasl - Type : ACT_GATHER_INFO |
2006-08-30 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200608-28.nasl - Type : ACT_GATHER_INFO |
2006-08-25 | Name : The remote web server uses a version of PHP that is affected by multiple flaws. File : php_4_4_3.nasl - Type : ACT_GATHER_INFO |
2006-07-17 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2006-122.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2014-02-17 11:50:13 |
|
2013-05-11 12:23:37 |
|