The php_next_marker function in image.c for PHP 4.2.2, 4.3.9, 4.3.10 and 5.0.3, as reachable by the getimagesize PHP function, allows remote attackers to cause a denial of service (infinite loop) via a JPEG image with an invalid marker value, which causes a negative length value to be passed to php_stream_seek.

Updated PHP packages that fix various security issues are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server.

A bug was found in the way PHP processes IFF and JPEG images. It is possible to cause PHP to consume CPU resources for a short period of time by supplying a carefully crafted IFF or JPEG image. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2005-0524 and CVE-2005-0525 to these issues.

A buffer overflow bug was also found in the way PHP processes EXIF image headers. It is possible for an attacker to construct an image file in such a way it could execute arbitrary instructions when processed by PHP. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1042 to this issue.

A denial of service bug was found in the way PHP processes EXIF image headers. It is possible for an attacker to cause PHP to enter an infinite loop for a short period of time by supplying a carefully crafted image file to PHP for processing. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1043 to this issue.

Several bug fixes are also included in this update :

  - some performance issues in the unserialize() function     have been fixed

  - the behaviour of the interpreter when handling integer     overflow during conversion of a floating variable to an     integer has been reverted to match the behaviour used     upstream; the integer will now be wrapped rather than     truncated

  - a fix for the virtual() function in the Apache httpd     module which would flush the response prematurely

  - the hard-coded default 'safe mode' setting is now     'disabled' rather than 'enabled'; to match the default     /etc/php.ini setting

  - in the curl extension, safe mode was not enforced for     'file:///' URL lookups (CVE-2004-1392).

Users of PHP should upgrade to these updated packages, which contain backported fixes for these issues.

Updated PHP packages that fix various security issues are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server.

A bug was found in the way PHP processes IFF and JPEG images. It is possible to cause PHP to consume CPU resources for a short period of time by supplying a carefully crafted IFF or JPEG image. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2005-0524 and CVE-2005-0525 to these issues.

A buffer overflow bug was also found in the way PHP processes EXIF image headers. It is possible for an attacker to construct an image file in such a way that it could execute arbitrary instructions when processed by PHP. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1042 to this issue.

A denial of service bug was found in the way PHP processes EXIF image headers. It is possible for an attacker to cause PHP to enter an infinite loop for a short period of time by supplying a carefully crafted image file to PHP for processing. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1043 to this issue.

Several bug fixes are also included in this update :

  - The security fixes in RHSA-2004-687 to the     'unserializer' code introduced some performance issues.

  - In the gd extension, the 'imagecopymerge' function did     not correctly handle transparency. The original image     was being obscured in the resultant image.

  - In the curl extension, safe mode was not enforced for     'file:///' URL lookups (CVE-2004-1392).

Users of PHP should upgrade to these updated packages, which contain backported fixes for these issues.

Two Denial of Service vulnerabilities have been discovered in the getimagesize() function. getimagesize() uses format specific internal functions php_handle_iff() and php_handle_jpeg() which get stuck in infinite loops when certain (invalid) size parameters are read from the image. In web applications that allow users to upload arbitrary image files, a remote attacker could render the server unavailable by uploading specially crafted images.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An iDEFENSE researcher discovered two problems in the image processing functions of PHP, a server-side, HTML-embedded scripting language, of which one is present in woody as well. When reading a JPEG image, PHP can be tricked into an endless loop due to insufficient input validation.

The remote host is missing Security Update 2005-006. This security update contains security fixes for the following application :

- AFP Server
- Bluetooth
- CoreGraphics
- Folder Permissions
- launchd
- LaunchServices
- NFS
- PHP
- VPN

These programs have multiple vulnerabilities, some of which may lead to arbitrary code execution.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2005:406 advisory.

    PHP is an HTML-embedded scripting language commonly used with the Apache     HTTP Web server.

    A bug was found in the way PHP processes IFF and JPEG images. It is     possible to cause PHP to consume CPU resources for a short period of time     by supplying a carefully crafted IFF or JPEG image. The Common     Vulnerabilities and Exposures project (cve.mitre.org) has assigned the     names CAN-2005-0524 and CAN-2005-0525 to these issues.

    A buffer overflow bug was also found in the way PHP processes EXIF image     headers. It is possible for an attacker to construct an image file in such     a way it could execute arbitrary instructions when processed by PHP. The     Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned     the name CAN-2005-1042 to this issue.

    A denial of service bug was found in the way PHP processes EXIF image     headers. It is possible for an attacker to cause PHP to enter an infinite     loop for a short period of time by supplying a carefully crafted image file     to PHP for processing. The Common Vulnerabilities and Exposures project     (cve.mitre.org) has assigned the name CAN-2005-1043 to this issue.

    Several bug fixes are also included in this update:

    - some performance issues in the unserialize() function have been fixed

    - the behaviour of the interpreter when handling integer overflow during     conversion of a floating variable to an integer has been reverted to match     the behaviour used upstream; the integer will now be wrapped rather than     truncated

    - a fix for the virtual() function in the Apache httpd module which would     flush the response prematurely

    - the hard-coded default safe mode setting is now disabled rather than     enabled; to match the default /etc/php.ini setting

    - in the curl extension, safe mode was not enforced for 'file:///' URL     lookups (CAN-2004-1392).

    Users of PHP should upgrade to these updated packages, which contain     backported fixes for these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A number of vulnerabilities are addressed in this PHP update :

Stefano Di Paolo discovered integer overflows in PHP's pack(), unpack(), and shmop_write() functions which could allow a malicious script to break out of safe mode and execute arbitrary code with privileges of the PHP interpreter (CVE-2004-1018; this was previously fixed in Mandrakelinux >= 10.0 in MDKSA-2004:151).

Stefan Esser discovered two safe mode bypasses which would allow malicious scripts to circumvent path restrictions by using virtual_popen() with a current directory containing shell meta- characters (CVE-2004-1063) or by creating a specially crafted directory whose length exceeded the capacity of realpath() (CVE-2004-1064; both of these were previously fixed in Mandrakelinux >= 10.0 in MDKSA-2004:151).

Two Denial of Service vulnerabilities were found in the getimagesize() function which uses the format-specific internal functions php_handle_iff() and php_handle_jpeg() which would get stuck in infinite loops when certain (invalid) size parameters are read from the image (CVE-2005-0524 and CVE-2005-0525).

An integer overflow was discovered in the exif_process_IFD_TAG() function in PHP's EXIF module. EXIF tags with a specially crafted 'Image File Directory' (IFD) tag would cause a buffer overflow which could be exploited to execute arbitrary code with the privileges of the PHP server (CVE-2005-1042).

Another vulnerability in the EXIF module was also discovered where headers with a large IFD nesting level would cause an unbound recursion which would eventually overflow the stack and cause the executed program to crash (CVE-2004-1043).

All of these issues are addressed in the Corporate Server 2.1 packages and the last three issues for all other platforms, which had previously included the first two issues but had not been mentioned in MDKSA-2004:151.

The remote host is affected by the vulnerability described in GLSA-200504-15 (PHP: Multiple vulnerabilities)

    An integer overflow and an unbound recursion were discovered in     the processing of Image File Directory tags in PHP's EXIF module     (CAN-2005-1042, CAN-2005-1043). Furthermore, two infinite loops have     been discovered in the getimagesize() function when processing IFF or     JPEG images (CAN-2005-0524, CAN-2005-0525).
  Impact :

    A remote attacker could craft an image file with a malicious EXIF     IFD tag, a large IFD nesting level or invalid size parameters and send     it to a web application that would process this user-provided image     using one of the affected functions. This could result in denying     service on the attacked server and potentially executing arbitrary code     with the rights of the web server.
  Workaround :

    There is no known workaround at this time.

The remote host is missing the patch for the advisory SUSE-SA:2005:023 (php4, php5).


This update fixes the following security issues in the PHP scripting language:

- A bug in getimagesize() EXIF handling which could lead to a denial of service attack.

This is tracked by the Mitre CVE IDs  CVE-2005-0524 and CVE-2005-0525.

Additionally this non-security bug was fixed:
- Performance problems of unserialize() caused by previous security fix to unserialize were fixed.

All SUSE Linux based distributions shipping php4 and php5 were affected.

An iDEFENSE researcher discovered two problems in the image processing functions of PHP, a server-side, HTML-embedded scripting language, of which one is present in PHP3 as well. When reading a JPEG image, PHP can be tricked into an endless loop due to insufficient input validation.

According to its banner, the version of PHP installed on the remote host is vulnerable to a denial of service attack due to its failure to properly validate file data in the routines 'php_handle_iff' and 'php_handle_jpeg', which are called by the PHP function 'getimagesize'.  Using a specially crafted image file, an attacker can trigger an infinite loop when 'getimagesize' is called, perhaps even remotely in the cases where image uploads are allowed.

The remote host is running a version of PHP that is older than 4.3.11 or 5.0.4.  This version contains a bug that can be triggered when the getimagesize() function processes malicious IFF or JPEG image files.  An attacker exploiting this flaw would be able to present an image to the function that would cause the function to go into an infinite loop by processing a negative file size.  A successful exploit would result in the loss of system availability for valid users.  There is also a reported flaw in the way that PHP handles data being passed to the Image File Directory (IFD).  Reportedly, this leads to a remote Denial of Service (DoS) attack.   Other flaws impacting this version of PHP have been reported; however, details have not been released.

The remote host is missing Security Update 2005-001. This security update contains a number of enhancements for the following programs :

 - at commands
 - ColorSync
 - libxml2
 - Mail
 - PHP
 - Safari
 - SquirrelMail
 

ID	Name	Product	Family	Severity
23981	CentOS 4 : PHP (CESA-2005:406)	Nessus	CentOS Local Security Checks	high
21818	CentOS 3 : PHP (CESA-2005:405)	Nessus	CentOS Local Security Checks	high
20491	Ubuntu 4.10 : php4 vulnerabilities (USN-105-1)	Nessus	Ubuntu Local Security Checks	medium
18516	Debian DSA-729-1 : php4 - missing input sanitising	Nessus	Debian Local Security Checks	medium
18437	Mac OS X Multiple Vulnerabilities (Security Update 2005-006)	Nessus	MacOS X Local Security Checks	high
18198	RHEL 4 : PHP (RHSA-2005:406)	Nessus	Red Hat Local Security Checks	high
18163	RHEL 3 : PHP (RHSA-2005:405)	Nessus	Red Hat Local Security Checks	high
18091	Mandrake Linux Security Advisory : php (MDKSA-2005:072)	Nessus	Mandriva Local Security Checks	critical
18081	GLSA-200504-15 : PHP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
18057	SUSE-SA:2005:023: php4, php5	Nessus	SuSE Local Security Checks	medium
18053	Debian DSA-708-1 : php3 - missing input sanitising	Nessus	Debian Local Security Checks	medium
17687	PHP Multiple Image Processing Functions File Handling DoS	Nessus	CGI abuses	medium
2782	PHP Remote getimagesize DoS	Nessus Network Monitor	Web Servers	high
2555	Mac OS X Multiple Vulnerabilities (Security Update 2005-001)	Nessus Network Monitor	Web Clients	critical
801089	PHP Remote getimagesize DoS	Log Correlation Engine	Web Servers	high
800804	Mac OS X Multiple Vulnerabilities (Security Update 2005-001)	Log Correlation Engine	Operating System Detection	high

Detections

Analytics

CVE-2005-0525

medium

Tenable Plugins

high

high

medium

medium

high

high

high

critical

high

medium

medium

medium

high

critical

high

high