The stripos function in PHP before 5.1.5 has unknown impact and attack vectors related to an out-of-bounds read.

According to its banner, the version of PHP 5.x installed on the remote host is older than 5.1.5.  Such versions may be affected by the following vulnerabilities :

  - The c-client library 2000, 2001, or 2004 for PHP does     not check the safe_mode or open_basedir functions.
    (CVE-2006-1017)

  - A buffer overflow exists in the sscanf function.
    (CVE-2006-4020)

  - The file_exists and imap_reopen functions do not check     for the safe_mode and open_basedir settings, which     allows local users to bypass the settings.     (CVE-2006-4481)

  - Multiple heap-based buffer overflows exist in the     str_repeat and wordwrap functions in     ext/standard/string.c. (CVE-2006-4482)

  - The cURL extension files permit the     CURLOPT_FOLLOWLOCATION option when open_basedir or     safe_mode is enabled, which allows attackers to perform     unauthorized actions. (CVE-2006-4483)

  - A buffer overflow vulnerability exists in the     LWZReadByte_ function in ext/gd/libgd/gd_gif_in.c in the     GD extension. (CVE-2006-4484)

  - The stripos function is affected by an out-of-bounds     read. (CVE-2006-4485)

The stripos() function did not check for invalidly long or empty haystack strings. In an application that uses this function on arbitrary untrusted data this could be exploited to crash the PHP interpreter. (CVE-2006-4485)

An integer overflow was discovered in the PHP memory allocation handling. On 64-bit platforms, the 'memory_limit' setting was not enforced correctly. A remote attacker could exploit this to cause a Denial of Service attack through memory exhaustion. (CVE-2006-4486)

Maksymilian Arciemowicz discovered that security relevant configuration options like open_basedir and safe_mode (which can be configured in Apache's httpd.conf) could be bypassed and reset to their default value in php.ini by using the ini_restore() function.
(CVE-2006-4625)

Stefan Esser discovered that the ecalloc() function in the Zend engine did not check for integer overflows. This particularly affected the unserialize() function. In applications which unserialize untrusted user-defined data, this could be exploited to execute arbitrary code with the application's privileges. (CVE-2006-4812).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The (1) file_exists and (2) imap_reopen functions in PHP before 5.1.5 do not check for the safe_mode and open_basedir settings, which allows local users to bypass the settings (CVE-2006-4481).

Buffer overflow in the LWZReadByte function in ext/gd/libgd/gd_gif_in.c in the GD extension in PHP before 5.1.5 allows remote attackers to have an unknown impact via a GIF file with input_code_size greater than MAX_LWZ_BITS, which triggers an overflow when initializing the table array (CVE-2006-4484).

The stripos function in PHP before 5.1.5 has unknown impact and attack vectors related to an out-of-bounds read (CVE-2006-4485).

CVE-2006-4485 does not affect the Corporate3 or MNF2 versions of PHP.

Updated packages have been patched to correct these issues.

The remote host is running a version of PHP that is older than 4.4.4 or 5.1.5.  This version is reported vulnerable to several flaws that may allow an attacker with the right to execute PHP scripts the ability to execute arbitrary code.  Executed code would be run with the permissions of the web server process. 

The PHP development team reports :

- Added missing safe_mode/open_basedir checks inside the error_log(), file_exists(), imap_open() and imap_reopen() functions.

- Fixed overflows inside str_repeat() and wordwrap() functions on 64bit systems.

- Fixed possible open_basedir/safe_mode bypass in cURL extension and with realpath cache.

- Fixed overflow in GD extension on invalid GIF images.

- Fixed a buffer overflow inside sscanf() function.

- Fixed an out of bounds read inside stripos() function.

- Fixed memory_limit restriction on 64 bit system.

The remote host is running a version of PHP that is older than 4.4.4 or 5.1.5.  This version is reported vulnerable to several flaws that may allow an attacker with the right to execute PHP scripts the ability to execute arbitrary code.  Executed code would be run with the permissions of the web server process.

ID	Name	Product	Family	Severity
17713	PHP 5.1.x < 5.1.5 Multiple Vulnerabilities	Nessus	CGI abuses	critical
27942	Ubuntu 5.04 / 5.10 / 6.06 LTS : php4, php5 vulnerabilities (USN-362-1)	Nessus	Ubuntu Local Security Checks	critical
23906	Mandrake Linux Security Advisory : php (MDKSA-2006:162)	Nessus	Mandriva Local Security Checks	critical
3732	PHP 4.x < 4.4.4 / 5.x < 5.1.4 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	medium
22343	FreeBSD : php -- multiple vulnerabilities (ea09c5df-4362-11db-81e1-000e0c2e438a)	Nessus	FreeBSD Local Security Checks	critical
801073	PHP < 4.4.4 / 5.1.4 Multiple Vulnerabilities	Log Correlation Engine	Web Servers	high

Detections

Analytics

CVE-2006-4485

critical

Tenable Plugins

critical

critical

critical

medium

critical

high