Executive Summary
This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
| Summary | |
|---|---|
| Title | PHP vulnerabilities |
| Informations | |||
|---|---|---|---|
| Name | USN-320-1 | First vendor Publication | 2006-07-19 |
| Vendor | Ubuntu | Last vendor Modification | 2006-07-19 |
| Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 9.3 | Attack Range | Network |
| Cvss Impact Score | 10 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| A security issue affects the following Ubuntu releases: Ubuntu 5.04 Ubuntu 5.10 Ubuntu 6.06 LTS This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu. The problem can be corrected by upgrading your system to the following package versions: Ubuntu 5.04: Ubuntu 5.10: Ubuntu 6.06 LTS: In general, a standard system upgrade is sufficient to effect the necessary changes. Details follow: The phpinfo() PHP function did not properly sanitize long strings. A remote attacker could use this to perform cross-site scripting attacks against sites that have publicly-available PHP scripts that call phpinfo(). Please note that it is not recommended to publicly expose phpinfo(). (CVE-2006-0996) An information disclosure has been reported in the html_entity_decode() function. A script which uses this function to process arbitrary user-supplied input could be exploited to expose a random part of memory, which could potentially reveal sensitive data. (CVE-2006-1490) The wordwrap() function did not sufficiently check the validity of the 'break' argument. An attacker who could control the string passed to the 'break' parameter could cause a heap overflow; however, this should not happen in practical applications. (CVE-2006-1990) The substr_compare() function did not sufficiently check the validity of the 'offset' argument. A script which passes untrusted user-defined values to this parameter could be exploited to crash the PHP interpreter. (CVE-2006-1991) In certain situations, using unset() to delete a hash entry could cause the deletion of the wrong element, which would leave the specified variable defined. This could potentially cause information disclosure in security-relevant operations. (CVE-2006-3017) In certain situations the session module attempted to close a data file twice, which led to memory corruption. This could potentially be exploited to crash the PHP interpreter, though that could not be verified. (CVE-2006-3018) This update also fixes various bugs which allowed local scripts to bypass open_basedir and 'safe mode' restrictions by passing special arguments to tempnam() (CVE-2006-1494, CVE-2006-2660), copy() (CVE-2006-1608), the curl module (CVE-2006-2563), or error_log() (CVE-2006-3011). |
Original Source
| Url : http://www.ubuntu.com/usn/USN-320-1 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 33 % | CWE-399 | Resource Management Errors |
| 33 % | CWE-264 | Permissions, Privileges, and Access Controls |
| 33 % | CWE-79 | Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25) |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:10118 | |||
| Oval ID: | oval:org.mitre.oval:def:10118 | ||
| Title: | zend_hash_del_key_or_index in zend_hash.c in PHP before 4.4.3 and 5.x before 5.1.3 can cause zend_hash_del to delete the wrong element, which prevents a variable from being unset even when the PHP unset function is called, which might cause the variable's value to be used in security-relevant operations. | ||
| Description: | zend_hash_del_key_or_index in zend_hash.c in PHP before 4.4.3 and 5.x before 5.1.3 can cause zend_hash_del to delete the wrong element, which prevents a variable from being unset even when the PHP unset function is called, which might cause the variable's value to be used in security-relevant operations. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2006-3017 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:10597 | |||
| Oval ID: | oval:org.mitre.oval:def:10597 | ||
| Title: | Unspecified vulnerability in session.c in PHP before 5.1.3 has unknown impact and attack vectors, related to "certain characters in session names," including special characters that are frequently associated with CRLF injection, SQL injection, cross-site scripting (XSS), and HTTP response splitting vulnerabilities. NOTE: while the nature of the vulnerability is unspecified, it is likely that this is related to a violation of an expectation by PHP applications that the session name is alphanumeric, as implied in the PHP manual for session_name(). | ||
| Description: | Unspecified vulnerability in session.c in PHP before 5.1.3 has unknown impact and attack vectors, related to "certain characters in session names," including special characters that are frequently associated with CRLF injection, SQL injection, cross-site scripting (XSS), and HTTP response splitting vulnerabilities. NOTE: while the nature of the vulnerability is unspecified, it is likely that this is related to a violation of an expectation by PHP applications that the session name is alphanumeric, as implied in the PHP manual for session_name(). | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2006-3016 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:10997 | |||
| Oval ID: | oval:org.mitre.oval:def:10997 | ||
| Title: | Cross-site scripting (XSS) vulnerability in phpinfo (info.c) in PHP 5.1.2 and 4.4.2 allows remote attackers to inject arbitrary web script or HTML via long array variables, including (1) a large number of dimensions or (2) long values, which prevents HTML tags from being removed. | ||
| Description: | Cross-site scripting (XSS) vulnerability in phpinfo (info.c) in PHP 5.1.2 and 4.4.2 allows remote attackers to inject arbitrary web script or HTML via long array variables, including (1) a large number of dimensions or (2) long values, which prevents HTML tags from being removed. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2006-0996 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:11084 | |||
| Oval ID: | oval:org.mitre.oval:def:11084 | ||
| Title: | PHP before 5.1.3-RC1 might allow remote attackers to obtain portions of memory via crafted binary data sent to a script that processes user input in the html_entity_decode function and sends the encoded results back to the client, aka a "binary safety" issue. NOTE: this issue has been referred to as a "memory leak," but it is an information leak that discloses memory contents. | ||
| Description: | PHP before 5.1.3-RC1 might allow remote attackers to obtain portions of memory via crafted binary data sent to a script that processes user input in the html_entity_decode function and sends the encoded results back to the client, aka a "binary safety" issue. NOTE: this issue has been referred to as a "memory leak," but it is an information leak that discloses memory contents. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2006-1490 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:9696 | |||
| Oval ID: | oval:org.mitre.oval:def:9696 | ||
| Title: | Integer overflow in the wordwrap function in string.c in PHP 4.4.2 and 5.1.2 might allow context-dependent attackers to execute arbitrary code via certain long arguments that cause a small buffer to be allocated, which triggers a heap-based buffer overflow in a memcpy function call, a different vulnerability than CVE-2002-1396. | ||
| Description: | Integer overflow in the wordwrap function in string.c in PHP 4.4.2 and 5.1.2 might allow context-dependent attackers to execute arbitrary code via certain long arguments that cause a small buffer to be allocated, which triggers a heap-based buffer overflow in a memcpy function call, a different vulnerability than CVE-2002-1396. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2006-1990 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2012-06-21 | Name : PHP version smaller than 5.2.0 File : nvt/nopsec_php_5_2_0.nasl |
| 2009-11-17 | Name : Mac OS X Version File : nvt/macosx_version.nasl |
| 2009-10-10 | Name : SLES9: Security update for PHP4 File : nvt/sles9p5015565.nasl |
| 2008-09-24 | Name : Gentoo Security Advisory GLSA 200605-08 (php) File : nvt/glsa_200605_08.nasl |
| 2008-01-17 | Name : Debian Security Advisory DSA 1206-1 (php4) File : nvt/deb_1206_1.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 28006 | PHP error_log() Function open_basedir/safe_mode Bypass PHP contains a flaw that may allow an attacker to bypass security restrictions. The issue is due to the error_log() function not properly sanitizing user-supplied input. By using crafted input, an attacker may be able to bypass the safe_mode and open_basedir security restrictions. |
| 27080 | PHP tempname() Function Buffer Consumption File Name Restriction Bypass |
| 26827 | PHP error_log() Third Argument Safe Mode Bypass PHP contains a flaw that may allow a malicious user to bypass the safe mode protection. The issue is triggered when error_log() function fails to validate the 'destination' variable. It is possible that the flaw may allow local users to bypass safe mode resulting in a loss of confidentiality and integrity. |
| 26466 | PHP zend_hash_del() Variable Unsetting Unspecified Issue PHP contains a flaw related to the zend_hash_del() variable that may allow an attacker to compromise a vulnerable system. No further details have been provided. |
| 25813 | PHP cURL library (libcurl) curl_init() Safe Mode Bypass PHP contains a flaw that may allow an attacker to bypass security restrictions. The issue is due to the cURL library (libcurl) not properly sanitizing user-supplied input to the curl_init() function. By passing a crafted file name to the function, an attacker can bypass safe mode restrictions and read arbitrary files via a file:// request and null characters. |
| 25255 | PHP unset() Function Variable Persistence PHP contains a flaw where variables will not have their data removed even after having been unset(). No further details have been provided. |
| 25254 | PHP Session Extension Heap Corruption Issue PHP contains a flaw related to session extension that may allow an attacker to cause a heap corruption. No further details have been provided. |
| 25253 | PHP Session Name Unspecified Character Weakness PHP contains a flaw related to the use of unspecified unusual characters in session names. No further details have been provided. |
| 24946 | PHP substr_compare() Function length Parameter Memory Corruption DoS |
| 24944 | PHP wordwrap() Function Overflow PHP contains a flaw that may allow a context-dependent attacker to gain elevated privileges. The issue is due the wordwrap function in string.c not properly sanitizing user-supplied input. By passing a crafted string an attacker could trigger a heap-based buffer overflow and execute arbitrary code. |
| 24487 | PHP copy() Function Safe Mode Bypass PHP contains a flaw that may allow a local user to bypass security restrictions. The issue is due to the copy function in file.c not properly sanitizing user-supplied input. By supplying a crafted compress.zlib:// URI, an attacker can bypass safe mode restrictions and read arbitrary files. |
| 24486 | PHP tempnam() Function open_basedir Restriction Bypass PHP contains a flaw that may allow malicious users to bypass security restrictions. The issue is due to file.c not properly sanitizing user-supplied input. This may allow an attacker to bypass the open_basedir restriction, traverse the file system and access arbitrary files. Additionally, a remote attacker may be able to create files in arbitrary directories via the tempnam() function. |
| 24484 | PHP phpinfo() Function Long Array XSS PHP contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not correctly validate large array values upon submission to the phpinfo() function. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity. |
| 24248 | PHP html_entity_decode() Function Memory Content Disclosure |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2013-07-12 | Name : The remote Oracle Linux host is missing a security update. File : oraclelinux_ELSA-2006-0730.nasl - Type : ACT_GATHER_INFO |
| 2008-03-25 | Name : The remote web server uses a version of PHP that is affected by multiple buff... File : php_5_2_0.nasl - Type : ACT_GATHER_INFO |
| 2007-12-13 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_apache2-mod_php5-2102.nasl - Type : ACT_GATHER_INFO |
| 2007-11-10 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-320-1.nasl - Type : ACT_GATHER_INFO |
| 2007-10-17 | Name : The remote openSUSE host is missing a security update. File : suse_php5-1590.nasl - Type : ACT_GATHER_INFO |
| 2007-10-17 | Name : The remote openSUSE host is missing a security update. File : suse_apache2-mod_php5-2039.nasl - Type : ACT_GATHER_INFO |
| 2007-02-18 | Name : The remote host is missing a vendor-supplied security patch File : suse_SA_2006_031.nasl - Type : ACT_GATHER_INFO |
| 2007-02-18 | Name : The remote host is missing a vendor-supplied security patch File : suse_SA_2006_052.nasl - Type : ACT_GATHER_INFO |
| 2007-02-18 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2006-196.nasl - Type : ACT_GATHER_INFO |
| 2007-01-17 | Name : The remote Fedora Core host is missing a security update. File : fedora_2006-289.nasl - Type : ACT_GATHER_INFO |
| 2006-11-20 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1206.nasl - Type : ACT_GATHER_INFO |
| 2006-09-22 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2006-0682.nasl - Type : ACT_GATHER_INFO |
| 2006-09-22 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2006-0669.nasl - Type : ACT_GATHER_INFO |
| 2006-09-22 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2006-0669.nasl - Type : ACT_GATHER_INFO |
| 2006-09-06 | Name : The remote web server contains a PHP script that is affected by a global vari... File : pmwiki_globals_overwrite.nasl - Type : ACT_ATTACK |
| 2006-09-02 | Name : The remote web server contains a PHP script that allows execution of arbitrar... File : e107_globals_overwrite.nasl - Type : ACT_ATTACK |
| 2006-08-25 | Name : The remote web server uses a version of PHP that is affected by multiple flaws. File : php_4_4_3.nasl - Type : ACT_GATHER_INFO |
| 2006-07-28 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2006-0567.nasl - Type : ACT_GATHER_INFO |
| 2006-07-17 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2006-122.nasl - Type : ACT_GATHER_INFO |
| 2006-07-13 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2006-0568.nasl - Type : ACT_GATHER_INFO |
| 2006-07-13 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2006-0568.nasl - Type : ACT_GATHER_INFO |
| 2006-07-03 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2006-0276.nasl - Type : ACT_GATHER_INFO |
| 2006-05-27 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2006-091.nasl - Type : ACT_GATHER_INFO |
| 2006-05-24 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2006-0501.nasl - Type : ACT_GATHER_INFO |
| 2006-05-13 | Name : The remote host is missing a vendor-supplied security patch File : suse_SA_2006_024.nasl - Type : ACT_GATHER_INFO |
| 2006-05-13 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200605-08.nasl - Type : ACT_GATHER_INFO |
| 2006-04-26 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2006-0276.nasl - Type : ACT_GATHER_INFO |
| 2006-04-26 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2006-074.nasl - Type : ACT_GATHER_INFO |
| 2006-04-04 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2006-063.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 12:03:38 |
|
| 2013-05-11 12:25:32 |
|
