The addslashes function in PHP 4.3.9 does not properly escape a NULL (/0) character, which may allow remote attackers to read arbitrary files in PHP applications that contain a directory traversal vulnerability in require or include statements, but are otherwise protected by the magic_quotes_gpc mechanism. NOTE: this issue was originally REJECTed by its CNA before publication, but that decision is in active dispute. This candidate may change significantly in the future as a result of further discussion.

The remote host is missing Security Update 2005-001. This security update contains a number of enhancements for the following programs :

 - at commands
 - ColorSync
 - libxml2
 - Mail
 - PHP
 - Safari
 - SquirrelMail
 

he remote host is missing Security Update 2005-001. This security update contains a number of fixes for the following programs :

  - at commands
  - ColorSync
  - libxml2
  - Mail
  - PHP
  - Safari
  - SquirrelMail

These programs have multiple vulnerabilities which may allow a remote attacker to execute arbitrary code.

The remote host is affected by the vulnerability described in GLSA-200412-14 (PHP: Multiple vulnerabilities)

    Stefan Esser and Marcus Boerger reported several different issues in     the unserialize() function, including serious exploitable bugs in the     way it handles negative references (CAN-2004-1019).
    Stefan Esser also discovered that the pack() and unpack() functions are     subject to integer overflows that can lead to a heap buffer overflow     and a heap information leak. Finally, he found that the way     multithreaded PHP handles safe_mode_exec_dir restrictions can be     bypassed, and that various path truncation issues also allow to bypass     path and safe_mode restrictions.
    Ilia Alshanetsky found a stack overflow issue in the exif_read_data()     function (CAN-2004-1065). Finally, Daniel Fabian found that addslashes     and magic_quotes_gpc do not properly escape null characters and that     magic_quotes_gpc contains a bug that could lead to one level directory     traversal.
  Impact :

    These issues could be exploited by a remote attacker to retrieve web     server heap information, bypass safe_mode or path restrictions and     potentially execute arbitrary code with the rights of the web server     running a PHP application.
  Workaround :

    There is no known workaround at this time.

A number of vulnerabilities in PHP versions prior to 4.3.10 were discovered by Stefan Esser. Some of these vulnerabilities were not deemed to be severe enough to warrant CVE names, however the packages provided, with the exception of the Corporate Server 2.1 packages, include fixes for all of the vulnerabilities, thanks to the efforts of the OpenPKG team who extracted and backported the fixes.

The vulnerabilities fixed in all provided packages include a fix for a possible information disclosure, double free, and negative reference index array underflow in deserialization code (CVE-2004-1019). As well, the exif_read_data() function suffers from an overflow on a long sectionname; this vulnerability was discovered by Ilia Alshanetsky (CVE-2004-1065).

The other fixes that appear in Mandrakelinux 9.2 and newer packages include a fix for out of bounds memory write access in shmop_write() and integer overflow/underflows in the pack() and unpack() functions.
The addslashes() function did not properly escape '&#0;' correctly. A directory bypass issue existed in safe_mode execution. There is an issue of arbitrary file access through path truncation. Finally, the 'magic_quotes_gpc' functionality could lead to one level directory traversal with file uploads.

According to its banner, the version of PHP installed on the remote host is prior to 4.3.10 / 5.0.3.  It is, therefore, affected by multiple security issues that could, under certain circumstances, allow an attacker to execute arbitrary code on the remote host, provided that the attacker can pass arbitrary data to some functions, or to bypass safe_mode.

The remote host is running a version of PHP which is older than 5.0.3 or 4.3.10.
The remote version of this software is vulnerable to various security issues that may, under certain circumstances, allow attackers to execute arbitrary code on the remote host, provided that they can pass arbitrary data to some functions or bypass safe_mode.

The remote host is missing Security Update 2005-001. This security update contains a number of enhancements for the following programs :

 - at commands
 - ColorSync
 - libxml2
 - Mail
 - PHP
 - Safari
 - SquirrelMail

ID	Name	Product	Family	Severity
2555	Mac OS X Multiple Vulnerabilities (Security Update 2005-001)	Nessus Network Monitor	Web Clients	critical
16251	Mac OS X Multiple Vulnerabilities (Security Update 2005-001)	Nessus	MacOS X Local Security Checks	high
16001	GLSA-200412-14 : PHP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
15998	Mandrake Linux Security Advisory : php (MDKSA-2004:151)	Nessus	Mandriva Local Security Checks	critical
15973	PHP < 4.3.10 / 5.0.3 Multiple Vulnerabilities	Nessus	CGI abuses	high
2460	PHP < 4.3.10 / 5.0.3 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	critical
801104	PHP < 4.3.10 / 5.0.3 Multiple Vulnerabilities	Log Correlation Engine	Web Servers	high
800804	Mac OS X Multiple Vulnerabilities (Security Update 2005-001)	Log Correlation Engine	Operating System Detection	high

Detections

Analytics

CVE-2004-1020

high

Tenable Plugins

critical

high

critical

critical

high

critical

high

high