The deserialization code in PHP before 4.3.10 and PHP 5.x up to 5.0.2 allows remote attackers to cause a denial of service and execute arbitrary code via untrusted data to the unserialize function that may trigger "information disclosure, double-free and negative reference index array underflow" results.

php5 was updated to fix four security issues.

These security issues were fixed :

  - CVE-2015-0231: Use-after-free vulnerability in the     process_nested_data function in     ext/standard/var_unserializer.re in PHP before 5.4.37,     5.5.x before 5.5.21, and 5.6.x before 5.6.5 allowed     remote attackers to execute arbitrary code via a crafted     unserialize call that leverages improper handling of     duplicate numerical keys within the serialized     properties of an object. NOTE: this vulnerability exists     because of an incomplete fix for CVE-2014-8142     (bnc#910659).

  - CVE-2014-9427: sapi/cgi/cgi_main.c in the CGI component     in PHP through 5.4.36, 5.5.x through 5.5.20, and 5.6.x     through 5.6.4, when mmap is used to read a .php file,     did not properly consider the mapping's length during     processing of an invalid file that begins with a #     character and lacks a newline character, which caused an     out-of-bounds read and might (1) allow remote attackers     to obtain sensitive information from php-cgi process     memory by leveraging the ability to upload a .php file     or (2) trigger unexpected code execution if a valid PHP     script is present in memory locations adjacent to the     mapping (bnc#911664).

  - CVE-2015-0232: The exif_process_unicode function in     ext/exif/exif.c in PHP before 5.4.37, 5.5.x before     5.5.21, and 5.6.x before 5.6.5 allowed remote attackers     to execute arbitrary code or cause a denial of service     (uninitialized pointer free and application crash) via     crafted EXIF data in a JPEG image (bnc#914690).

  - CVE-2014-8142: Use-after-free vulnerability in the     process_nested_data function in     ext/standard/var_unserializer.re in PHP before 5.4.36,     5.5.x before 5.5.20, and 5.6.x before 5.6.4 allowed     remote attackers to execute arbitrary code via a crafted     unserialize call that leverages improper handling of     duplicate keys within the serialized properties of an     object, a different vulnerability than CVE-2004-1019     (bnc#910659).

Additionally a fix was included that protects against a possible NULL pointer use (bnc#910659).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

php5 was updated to fix five security issues.

These security issues were fixed :

  - CVE-2015-0231: Use-after-free vulnerability in the     process_nested_data function in     ext/standard/var_unserializer.re in PHP before 5.4.37,     5.5.x before 5.5.21, and 5.6.x before 5.6.5 allowed     remote attackers to execute arbitrary code via a crafted     unserialize call that leverages improper handling of     duplicate numerical keys within the serialized     properties of an object. NOTE: this vulnerability exists     because of an incomplete fix for CVE-2014-8142     (bnc#910659).

  - CVE-2015-0232: The exif_process_unicode function in     ext/exif/exif.c in PHP before 5.4.37, 5.5.x before     5.5.21, and 5.6.x before 5.6.5 allowed remote attackers     to execute arbitrary code or cause a denial of service     (uninitialized pointer free and application crash) via     crafted EXIF data in a JPEG image (bnc#914690).

  - CVE-2014-8142: Use-after-free vulnerability in the     process_nested_data function in     ext/standard/var_unserializer.re in PHP before 5.4.36,     5.5.x before 5.5.20, and 5.6.x before 5.6.4 allowed     remote attackers to execute arbitrary code via a crafted     unserialize call that leverages improper handling of     duplicate keys within the serialized properties of an     object, a different vulnerability than CVE-2004-1019     (bnc#910659).

  - CVE-2014-9427: sapi/cgi/cgi_main.c in the CGI component     in PHP through 5.4.36, 5.5.x through 5.5.20, and 5.6.x     through 5.6.4, when mmap was used to read a .php file,     did not properly consider the mapping's length during     processing of an invalid file that begins with a #     character and lacks a newline character, which caused an     out-of-bounds read and might (1) allowed remote     attackers to obtain sensitive information from php-cgi     process memory by leveraging the ability to upload a     .php file or (2) trigger unexpected code execution if a     valid PHP script is present in memory locations adjacent     to the mapping (bnc#911664).

For openSUSE 13.2 this additional security issue was fixed :

  - CVE-2014-9426: The apprentice_load function in     libmagic/apprentice.c in the Fileinfo component in PHP     through 5.6.4 attempted to perform a free operation on a     stack-based character array, which allowed remote     attackers to cause a denial of service (memory     corruption or application crash) or possibly have     unspecified other impact via unknown vectors     (bnc#911663).

Stefan Esser reported several buffer overflows in PHP's variable unserializing handling. These could allow an attacker to execute arbitrary code on the server with the PHP interpreter's privileges by sending specially crafted input strings (form data, cookie values, and similar).

Additionally, Ilia Alshanetsky discovered a buffer overflow in the exif_read_data() function. Attackers could execute arbitrary code on the server by sending a JPEG image with a very long 'sectionname' value to PHP applications that support image uploads.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated PHP packages that fix multiple security issues are now available for Red Hat Enterprise Linux 2.1

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server.

A flaw was found in the way PHP registers global variables during a file upload request. A remote attacker could submit a carefully crafted multipart/form-data POST request that would overwrite the $GLOBALS array, altering expected script behavior, and possibly leading to the execution of arbitrary PHP commands. Note that this vulnerability only affects installations which have register_globals enabled in the PHP configuration file, which is not a default or recommended option. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-3390 to this issue.

A flaw was found in the PHP parse_str() function. If a PHP script passes only one argument to the parse_str() function, and the script can be forced to abort execution during operation (for example due to the memory_limit setting), the register_globals may be enabled even if it is disabled in the PHP configuration file. This vulnerability only affects installations that have PHP scripts using the parse_str function in this way. (CVE-2005-3389)

A Cross-Site Scripting flaw was found in the phpinfo() function. If a victim can be tricked into following a malicious URL to a site with a page displaying the phpinfo() output, it may be possible to inject JavaScript or HTML content into the displayed page or steal data such as cookies. This vulnerability only affects installations which allow users to view the output of the phpinfo() function. As the phpinfo() function outputs a large amount of information about the current state of PHP, it should only be used during debugging or if protected by authentication. (CVE-2005-3388)

Additionally, a bug introduced in the updates to fix CVE-2004-1019 has been corrected.

Users of PHP should upgrade to these updated packages, which contain backported patches that resolve these issues.

Secunia reports :

Multiple vulnerabilities have been reported in PHP, which can be exploited to gain escalated privileges, bypass certain security restrictions, gain knowledge of sensitive information, or compromise a vulnerable system.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2005:032 advisory.

    PHP is an HTML-embedded scripting language commonly used with the Apache     HTTP Web server.

    Flaws including possible information disclosure, double free, and negative     reference index array underflow were found in the deserialization code of     PHP. PHP applications may use the unserialize function on untrusted user     data, which could allow a remote attacker to gain access to memory or     potentially execute arbitrary code. The Common Vulnerabilities and     Exposures project (cve.mitre.org) has assigned the name CAN-2004-1019 to     this issue.

    A flaw in the exif extension of PHP was found which lead to a stack     overflow. An attacker could create a carefully crafted image file in such     a way which, if parsed by a PHP script using the exif extension, could     cause a crash or potentially execute arbitrary code. The Common     Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name     CAN-2004-1065 to this issue.

    Flaws were found in shmop_write, pack, and unpack PHP functions. These     functions are not normally passed user supplied data, so would require a     malicious PHP script to be exploited. The Common Vulnerabilities and     Exposures project (cve.mitre.org) has assigned the name CAN-2004-1018 to     this issue.

    Users of PHP should upgrade to these updated packages, which contain fixes     for these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is missing the patch for the advisory SUSE-SA:2005:002 (php4, mod_php4).


PHP is a well known, widely-used scripting language often used within web server setups.

Stefan Esser and Marcus Boerger found several buffer overflow problems in the unserializer functions of PHP (CVE-2004-1019) and Ilia Alshanetsky (CVE-2004-1065) found one in the exif parser. Any of them could allow remote attackers to execute arbitrary code as the user running the PHP interpreter.

Additionally a bug where the server would disclose php sourcecode under some circumstances has been fixed.

The remote host is missing Security Update 2005-001. This security update contains a number of enhancements for the following programs :

 - at commands
 - ColorSync
 - libxml2
 - Mail
 - PHP
 - Safari
 - SquirrelMail
 

he remote host is missing Security Update 2005-001. This security update contains a number of fixes for the following programs :

  - at commands
  - ColorSync
  - libxml2
  - Mail
  - PHP
  - Safari
  - SquirrelMail

These programs have multiple vulnerabilities which may allow a remote attacker to execute arbitrary code.

Updated php packages that fix various security issues are now available for Red Hat Enterprise Linux 2.1.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server.

A double-free bug was found in the deserialization code of PHP. PHP applications use the unserialize function on untrusted user data, which could allow a remote attacker to gain access to memory or potentially execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1019 to this issue.

Flaws were found in the pack and unpack PHP functions. These functions do not normally pass user-supplied data, so they would require a malicious PHP script to be exploited. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1018 to this issue.

A bug was discovered in the initialization of the OpenSSL library, such that the curl extension could not be used to perform HTTP requests over SSL unless the php-imap package was installed.

Users of PHP should upgrade to these updated packages, which contain fixes for these issues.

Updated php packages that fix various security issues and bugs are now available for Red Hat Enterprise Linux 3.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server.

Flaws including possible information disclosure, double free, and negative reference index array underflow were found in the deserialization code of PHP. PHP applications may use the unserialize function on untrusted user data, which could allow a remote attacker to gain access to memory or potentially execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1019 to this issue.

A flaw in the exif extension of PHP was found which lead to a stack overflow. An attacker could create a carefully crafted image file in such a way that if parsed by a PHP script using the exif extension it could cause a crash or potentially execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1065 to this issue.

An information disclosure bug was discovered in the parsing of 'GPC' variables in PHP (query strings or cookies, and POST form data). If particular scripts used the values of the GPC variables, portions of the memory space of an httpd child process could be revealed to the client. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0958 to this issue.

A file access bug was discovered in the parsing of 'multipart/form-data' forms, used by PHP scripts which allow file uploads. In particular configurations, some scripts could allow a malicious client to upload files to an arbitrary directory where the 'apache' user has write access. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0959 to this issue.

Flaws were found in shmop_write, pack, and unpack PHP functions. These functions are not normally passed user-supplied data, so would require a malicious PHP script to be exploited. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1018 to this issue.

Various issues were discovered in the use of the 'select' system call in PHP, which could be triggered if PHP is used in an Apache configuration where the number of open files (such as virtual host log files) exceeds the default process limit of 1024. Workarounds are now included for some of these issues.

The 'phpize' shell script included in PHP can be used to build third-party extension modules. A build issue was discovered in the 'phpize' script on some 64-bit platforms which prevented correct operation.

The 'pcntl' extension module is now enabled in the command line PHP interpreter, /usr/bin/php. This module enables process control features such as 'fork' and 'kill' from PHP scripts.

Users of PHP should upgrade to these updated packages, which contain fixes for these issues.

The remote host is affected by the vulnerability described in GLSA-200412-14 (PHP: Multiple vulnerabilities)

    Stefan Esser and Marcus Boerger reported several different issues in     the unserialize() function, including serious exploitable bugs in the     way it handles negative references (CAN-2004-1019).
    Stefan Esser also discovered that the pack() and unpack() functions are     subject to integer overflows that can lead to a heap buffer overflow     and a heap information leak. Finally, he found that the way     multithreaded PHP handles safe_mode_exec_dir restrictions can be     bypassed, and that various path truncation issues also allow to bypass     path and safe_mode restrictions.
    Ilia Alshanetsky found a stack overflow issue in the exif_read_data()     function (CAN-2004-1065). Finally, Daniel Fabian found that addslashes     and magic_quotes_gpc do not properly escape null characters and that     magic_quotes_gpc contains a bug that could lead to one level directory     traversal.
  Impact :

    These issues could be exploited by a remote attacker to retrieve web     server heap information, bypass safe_mode or path restrictions and     potentially execute arbitrary code with the rights of the web server     running a PHP application.
  Workaround :

    There is no known workaround at this time.

A number of vulnerabilities in PHP versions prior to 4.3.10 were discovered by Stefan Esser. Some of these vulnerabilities were not deemed to be severe enough to warrant CVE names, however the packages provided, with the exception of the Corporate Server 2.1 packages, include fixes for all of the vulnerabilities, thanks to the efforts of the OpenPKG team who extracted and backported the fixes.

The vulnerabilities fixed in all provided packages include a fix for a possible information disclosure, double free, and negative reference index array underflow in deserialization code (CVE-2004-1019). As well, the exif_read_data() function suffers from an overflow on a long sectionname; this vulnerability was discovered by Ilia Alshanetsky (CVE-2004-1065).

The other fixes that appear in Mandrakelinux 9.2 and newer packages include a fix for out of bounds memory write access in shmop_write() and integer overflow/underflows in the pack() and unpack() functions.
The addslashes() function did not properly escape '&#0;' correctly. A directory bypass issue existed in safe_mode execution. There is an issue of arbitrary file access through path truncation. Finally, the 'magic_quotes_gpc' functionality could lead to one level directory traversal with file uploads.

According to its banner, the version of PHP installed on the remote host is prior to 4.3.10 / 5.0.3.  It is, therefore, affected by multiple security issues that could, under certain circumstances, allow an attacker to execute arbitrary code on the remote host, provided that the attacker can pass arbitrary data to some functions, or to bypass safe_mode.

The remote host is running a version of PHP which is older than 5.0.3 or 4.3.10.
The remote version of this software is vulnerable to various security issues that may, under certain circumstances, allow attackers to execute arbitrary code on the remote host, provided that they can pass arbitrary data to some functions or bypass safe_mode.

The remote host is missing Security Update 2005-001. This security update contains a number of enhancements for the following programs :

 - at commands
 - ColorSync
 - libxml2
 - Mail
 - PHP
 - Safari
 - SquirrelMail

ID	Name	Product	Family	Severity
119961	SUSE SLES12 Security Update : php5 (SUSE-SU-2015:0365-1)	Nessus	SuSE Local Security Checks	critical
93161	SUSE SLES11 Security Update : php53 (SUSE-SU-2016:1638-1) (BACKRONYM)	Nessus	SuSE Local Security Checks	critical
81418	openSUSE Security Update : php5 (openSUSE-2015-163)	Nessus	SuSE Local Security Checks	critical
20657	Ubuntu 4.10 : php4 vulnerabilities (USN-40-1)	Nessus	Ubuntu Local Security Checks	critical
20207	RHEL 2.1 : php (RHSA-2005:838)	Nessus	Red Hat Local Security Checks	critical
19133	FreeBSD : php -- multiple vulnerabilities (d47e9d19-5016-11d9-9b5f-0050569f0001)	Nessus	FreeBSD Local Security Checks	critical
17166	RHEL 4 : php (RHSA-2005:032)	Nessus	Red Hat Local Security Checks	critical
16306	SUSE-SA:2005:002: php4, mod_php4	Nessus	SuSE Local Security Checks	critical
2555	Mac OS X Multiple Vulnerabilities (Security Update 2005-001)	Nessus Network Monitor	Web Clients	critical
16251	Mac OS X Multiple Vulnerabilities (Security Update 2005-001)	Nessus	MacOS X Local Security Checks	high
16222	RHEL 2.1 : php (RHSA-2005:031)	Nessus	Red Hat Local Security Checks	critical
16041	RHEL 3 : php (RHSA-2004:687)	Nessus	Red Hat Local Security Checks	critical
16001	GLSA-200412-14 : PHP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
15998	Mandrake Linux Security Advisory : php (MDKSA-2004:151)	Nessus	Mandriva Local Security Checks	critical
15973	PHP < 4.3.10 / 5.0.3 Multiple Vulnerabilities	Nessus	CGI abuses	high
2460	PHP < 4.3.10 / 5.0.3 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	critical
801104	PHP < 4.3.10 / 5.0.3 Multiple Vulnerabilities	Log Correlation Engine	Web Servers	high
800804	Mac OS X Multiple Vulnerabilities (Security Update 2005-001)	Log Correlation Engine	Operating System Detection	high

Detections

Analytics

CVE-2004-1019

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

high

critical

critical

critical

critical

high

critical

high

high