Executive Summary
This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
| Summary | |
|---|---|
| Title | PHP vulnerabilities |
| Informations | |||
|---|---|---|---|
| Name | USN-342-1 | First vendor Publication | 2006-09-07 |
| Vendor | Ubuntu | Last vendor Modification | 2006-09-07 |
| Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 9.3 | Attack Range | Network |
| Cvss Impact Score | 10 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| A security issue affects the following Ubuntu releases: Ubuntu 5.04 Ubuntu 5.10 Ubuntu 6.06 LTS This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu. The problem can be corrected by upgrading your system to the following package versions: Ubuntu 5.04: Ubuntu 5.10: Ubuntu 6.06 LTS: In general, a standard system upgrade is sufficient to effect the necessary changes. Details follow: The sscanf() function did not properly check array boundaries. In applications which use sscanf() with argument swapping, a remote attacker could potentially exploit this to crash the affected web application or even execute arbitrary code with the application's privileges. (CVE-2006-4020) The file_exists() and imap_reopen() functions did not perform proper open_basedir and safe_mode checks which could allow local scripts to bypass intended restrictions. (CVE-2006-4481) On 64 bit systems the str_repeat() and wordwrap() functions did not properly check buffer boundaries. Depending on the application, this could potentially be exploited to execute arbitrary code with the applications' privileges. This only affects the amd64 and sparc platforms. (CVE-2006-4482) A buffer overflow was discovered in the LWZReadByte_() function of the GIF image file parser. By tricking a PHP application into processing a specially crafted GIF image, a remote attacker could exploit this to execute arbitrary code with the application's privileges. (CVE-2006-4484) |
Original Source
| Url : http://www.ubuntu.com/usn/USN-342-1 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-787 | Out-of-bounds Write (CWE/SANS Top 25) |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:10121 | |||
| Oval ID: | oval:org.mitre.oval:def:10121 | ||
| Title: | Multiple heap-based buffer overflows in the (1) str_repeat and (2) wordwrap functions in ext/standard/string.c in PHP before 5.1.5, when used on a 64-bit system, have unspecified impact and attack vectors, a different vulnerability than CVE-2006-1990. | ||
| Description: | Multiple heap-based buffer overflows in the (1) str_repeat and (2) wordwrap functions in ext/standard/string.c in PHP before 5.1.5, when used on a 64-bit system, have unspecified impact and attack vectors, a different vulnerability than CVE-2006-1990. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2006-4482 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:11062 | |||
| Oval ID: | oval:org.mitre.oval:def:11062 | ||
| Title: | scanf.c in PHP 5.1.4 and earlier, and 4.4.3 and earlier, allows context-dependent attackers to execute arbitrary code via a sscanf PHP function call that performs argument swapping, which increments an index past the end of an array and triggers a buffer over-read. | ||
| Description: | scanf.c in PHP 5.1.4 and earlier, and 4.4.3 and earlier, allows context-dependent attackers to execute arbitrary code via a sscanf PHP function call that performs argument swapping, which increments an index past the end of an array and triggers a buffer over-read. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2006-4020 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:9004 | |||
| Oval ID: | oval:org.mitre.oval:def:9004 | ||
| Title: | Buffer overflow in the LWZReadByte_ function in ext/gd/libgd/gd_gif_in.c in the GD extension in PHP before 5.1.5 allows remote attackers to have an unknown impact via a GIF file with input_code_size greater than MAX_LWZ_BITS, which triggers an overflow when initializing the table array. | ||
| Description: | Buffer overflow in the LWZReadByte_ function in ext/gd/libgd/gd_gif_in.c in the GD extension in PHP before 5.1.5 allows remote attackers to have an unknown impact via a GIF file with input_code_size greater than MAX_LWZ_BITS, which triggers an overflow when initializing the table array. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2006-4484 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2012-06-21 | Name : PHP 5.1.x < 5.1.5 File : nvt/nopsec_php_5_1_5.nasl |
| 2012-06-21 | Name : PHP version smaller than 4.4.4 File : nvt/nopsec_php_4_4_4.nasl |
| 2009-10-13 | Name : SLES10: Security update for perl-Tk File : nvt/sles10_perl-Tk.nasl |
| 2009-10-10 | Name : SLES9: Security update for perl-Tk File : nvt/sles9p5021923.nasl |
| 2009-10-10 | Name : SLES9: Security update for PHP4 File : nvt/sles9p5015565.nasl |
| 2009-04-09 | Name : Mandriva Update for gd MDVSA-2008:038 (gd) File : nvt/gb_mandriva_MDVSA_2008_038.nasl |
| 2009-04-09 | Name : Mandriva Update for perl-Tk MDVSA-2008:077 (perl-Tk) File : nvt/gb_mandriva_MDVSA_2008_077.nasl |
| 2009-03-06 | Name : RedHat Update for gd RHSA-2008:0146-01 File : nvt/gb_RHSA-2008_0146-01_gd.nasl |
| 2009-02-27 | Name : CentOS Update for gd CESA-2008:0146 centos4 i386 File : nvt/gb_CESA-2008_0146_gd_centos4_i386.nasl |
| 2009-02-27 | Name : CentOS Update for gd CESA-2008:0146 centos4 x86_64 File : nvt/gb_CESA-2008_0146_gd_centos4_x86_64.nasl |
| 2009-02-16 | Name : Fedora Update for graphviz FEDORA-2008-1643 File : nvt/gb_fedora_2008_1643_graphviz_fc7.nasl |
| 2009-02-13 | Name : Fedora Update for tk FEDORA-2008-1131 File : nvt/gb_fedora_2008_1131_tk_fc7.nasl |
| 2009-02-13 | Name : Fedora Update for tk FEDORA-2008-1122 File : nvt/gb_fedora_2008_1122_tk_fc8.nasl |
| 2008-09-24 | Name : Gentoo Security Advisory GLSA 200608-28 (php) File : nvt/glsa_200608_28.nasl |
| 2008-09-04 | Name : FreeBSD Ports: sdl_image File : nvt/freebsd_sdl_image.nasl |
| 2008-09-04 | Name : FreeBSD Ports: php4, php5 File : nvt/freebsd_php40.nasl |
| 2008-01-17 | Name : Debian Security Advisory DSA 1206-1 (php4) File : nvt/deb_1206_1.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 28009 | PHP imap_reopen() Function open_basedir/safe_mode Bypass PHP contains a flaw that may allow an attacker to bypass security restrictions. The issue is due to the imap_reopen() function not properly sanitizing user-supplied input. By using crafted input, an attacker may be able to bypass the safe_mode and open_basedir security restrictions. |
| 28007 | PHP file_exists() Function open_basedir/safe_mode Bypass PHP contains a flaw that may allow an attacker to bypass security restrictions. The issue is due to the file_exists() function not properly sanitizing user-supplied input. By using crafted input, an attacker may be able to bypass the safe_mode and open_basedir security restrictions. |
| 28004 | PHP on 64-bit wordwrap() Function Overflow |
| 28003 | PHP on 64-bit str_repeat() Function Overflow |
| 28002 | PHP GD Extension GIF Processing Overflow |
| 27824 | PHP sscanf() Function Argument Swapping Overflow PHP contains a flaw that may allow a context-dependent attacker to elevate privileges. The issue is due to the sscanf function in scanf.c not properly sanitizing user-supplied input. Passing a crafted string to this function may trigger a buvver over-read allowing the execution of arbitrary code. |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2008-0146.nasl - Type : ACT_GATHER_INFO |
| 2013-07-12 | Name : The remote Oracle Linux host is missing a security update. File : oraclelinux_ELSA-2006-0730.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20080228_gd_on_SL4_x.nasl - Type : ACT_GATHER_INFO |
| 2011-11-18 | Name : The remote web server uses a version of PHP that is affected by multiple vuln... File : php_5_1_5.nasl - Type : ACT_GATHER_INFO |
| 2011-11-18 | Name : The remote web server uses a version of PHP that is affected by multiple vuln... File : php_4_4_4.nasl - Type : ACT_GATHER_INFO |
| 2009-09-24 | Name : The remote SuSE 9 host is missing a security-related patch. File : suse9_12093.nasl - Type : ACT_GATHER_INFO |
| 2009-04-23 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2008-038.nasl - Type : ACT_GATHER_INFO |
| 2009-04-23 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2008-077.nasl - Type : ACT_GATHER_INFO |
| 2008-06-09 | Name : The remote openSUSE host is missing a security update. File : suse_tkimg-5328.nasl - Type : ACT_GATHER_INFO |
| 2008-06-09 | Name : The remote openSUSE host is missing a security update. File : suse_tkimg-5320.nasl - Type : ACT_GATHER_INFO |
| 2008-03-04 | Name : The remote openSUSE host is missing a security update. File : suse_perl-Tk-5035.nasl - Type : ACT_GATHER_INFO |
| 2008-03-04 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_perl-Tk-5034.nasl - Type : ACT_GATHER_INFO |
| 2008-02-29 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2008-0146.nasl - Type : ACT_GATHER_INFO |
| 2008-02-28 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2008-0146.nasl - Type : ACT_GATHER_INFO |
| 2008-02-14 | Name : The remote Fedora host is missing a security update. File : fedora_2008-1643.nasl - Type : ACT_GATHER_INFO |
| 2008-02-11 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200802-01.nasl - Type : ACT_GATHER_INFO |
| 2008-02-01 | Name : The remote openSUSE host is missing a security update. File : suse_SDL_image-4956.nasl - Type : ACT_GATHER_INFO |
| 2007-12-13 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_apache2-mod_php5-2102.nasl - Type : ACT_GATHER_INFO |
| 2007-11-10 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-342-1.nasl - Type : ACT_GATHER_INFO |
| 2007-10-17 | Name : The remote openSUSE host is missing a security update. File : suse_apache2-mod_php5-2039.nasl - Type : ACT_GATHER_INFO |
| 2007-02-18 | Name : The remote host is missing a vendor-supplied security patch File : suse_SA_2006_052.nasl - Type : ACT_GATHER_INFO |
| 2007-01-17 | Name : The remote Fedora Core host is missing a security update. File : fedora_2006-1024.nasl - Type : ACT_GATHER_INFO |
| 2006-12-16 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2006-162.nasl - Type : ACT_GATHER_INFO |
| 2006-12-16 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2006-144.nasl - Type : ACT_GATHER_INFO |
| 2006-11-20 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1206.nasl - Type : ACT_GATHER_INFO |
| 2006-09-22 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2006-0682.nasl - Type : ACT_GATHER_INFO |
| 2006-09-22 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2006-0669.nasl - Type : ACT_GATHER_INFO |
| 2006-09-22 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2006-0669.nasl - Type : ACT_GATHER_INFO |
| 2006-09-14 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_ea09c5df436211db81e1000e0c2e438a.nasl - Type : ACT_GATHER_INFO |
| 2006-08-30 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200608-28.nasl - Type : ACT_GATHER_INFO |
| 2006-07-17 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2006-122.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 12:03:44 |
|
