PHP 5.2.0 and 4.4 allows local users to bypass safe_mode and open_basedir restrictions via a malicious path and a null byte before a ";" in a session_save_path argument, followed by an allowed path, which causes a parsing inconsistency in which PHP validates the allowed path but sets session.save_path to the malicious path.

This update fixes security problems also fixed in PHP 5.2.1, including following problems :

  - Multiple buffer overflows in PHP before 5.2.1 allow     attackers to cause a denial of service and possibly     execute arbitrary code via unspecified vectors in the     (1) session, (2) zip, (3) imap, and (4) sqlite     extensions; (5) stream filters; and the (6) str_replace,     (7) mail, (8) ibase_delete_user, (9) ibase_add_user, and     (10) ibase_modify_user functions. (CVE-2007-0906)

  - Buffer underflow in PHP before 5.2.1 allows attackers to     cause a denial of service via unspecified vectors     involving the sapi_header_op function. (CVE-2007-0907)

  - The wddx extension in PHP before 5.2.1 allows remote     attackers to obtain sensitive information via     unspecified vectors. (CVE-2007-0908)

  - Multiple format string vulnerabilities in PHP before     5.2.1 might allow attackers to execute arbitrary code     via format string specifiers to (1) all of the *print     functions on 64-bit systems, and (2) the odbc_result_all     function. (CVE-2007-0909)

  - Unspecified vulnerability in PHP before 5.2.1 allows     attackers to 'clobber' certain super-global variables     via unspecified vectors. (CVE-2007-0910)

  - Off-by-one error in the str_ireplace function in PHP     5.2.1 might allow context-dependent attackers to cause a     denial of service (crash). (CVE-2007-0911)

  - PHP 5.2.0 and 4.4 allows local users to bypass safe_mode     and open_basedir restrictions via a malicious path and a     null byte before a ';' in a session_save_path argument,     followed by an allowed path, which causes a parsing     inconsistency in which PHP validates the allowed path     but sets session.save_path to the malicious path. And     another fix for open_basedir was added to stop mixing up     its setting in a virtual host environment.
    (CVE-2006-6383)

CVE-2007-0906: Multiple buffer overflows in PHP before 5.2.1 allow attackers to cause a denial of service and possibly execute arbitrary code via unspecified vectors in the (1) session, (2) zip, (3) imap, and (4) sqlite extensions; (5) stream filters; and the (6) str_replace, (7) mail, (8) ibase_delete_user, (9) ibase_add_user, and (10) ibase_modify_user functions.

CVE-2007-0907: Buffer underflow in PHP before 5.2.1 allows attackers to cause a denial of service via unspecified vectors involving the sapi_header_op function.

CVE-2007-0908: The wddx extension in PHP before 5.2.1 allows remote attackers to obtain sensitive information via unspecified vectors.

CVE-2007-0909: Multiple format string vulnerabilities in PHP before 5.2.1 might allow attackers to execute arbitrary code via format string specifiers to (1) all of the *print functions on 64-bit systems, and (2) the odbc_result_all function.

CVE-2007-0910: Unspecified vulnerability in PHP before 5.2.1 allows attackers to 'clobber' certain super-global variables via unspecified vectors.

CVE-2007-0911: Off-by-one error in the str_ireplace function in PHP 5.2.1 might allow context-dependent attackers to cause a denial of service (crash).

CVE-2006-6383: PHP 5.2.0 and 4.4 allows local users to bypass safe_mode and open_basedir restrictions via a malicious path and a null byte before a ';' in a session_save_path argument, followed by an allowed path, which causes a parsing inconsistency in which PHP validates the allowed path but sets session.save_path to the malicious path. And another fix for open_basedir was added to stop mixing up its setting in a virtual host environment.

According to its banner, the version of PHP installed on the remote host is older than 5.2.1.  Such versions may be affected by several issues, including buffer overflows, format string vulnerabilities, arbitrary code execution, 'safe_mode' and 'open_basedir' bypasses, and clobbering of super-globals.

PHP 5.2.0 and 4.4 allows local users to bypass safe_mode and open_basedir restrictions via a malicious path and a null byte before a ';' in a session_save_path argument, followed by an allowed path, which causes a parsing inconsistency in which PHP validates the allowed path but sets session.save_path to the malicious path.
(CVE-2006-6383)

Buffer overflow in the gdImageStringFTEx function in gdft.c in GD Graphics Library 2.0.33 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted string with a JIS encoded font. PHP uses an embedded copy of GD and may be susceptible to the same issue.
(CVE-2007-0455)

Updated packages have been patched to correct these issues. Users must restart Apache for the changes to take effect.

The remote host is running PHP less than 5.2.0.  This version is vulnerable to around 180 bugs.  An attacker exploiting these flaws would be able to impact confidentiality, integrity, and availability. 

ID	Name	Product	Family	Severity
29377	SuSE 10 Security Update : PHP5 (ZYPP Patch Number 2684)	Nessus	SuSE Local Security Checks	critical
27390	openSUSE 10 Security Update : php5 (php5-2687)	Nessus	SuSE Local Security Checks	critical
24907	PHP < 5.2.1 Multiple Vulnerabilities	Nessus	CGI abuses	high
24651	Mandrake Linux Security Advisory : php (MDKSA-2007:038)	Nessus	Mandriva Local Security Checks	high
3857	PHP < 4.4.5 / 5.2.1 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	medium
801112	PHP < 4.4.5 / 5.2.1 Multiple Vulnerabilities	Log Correlation Engine	Web Servers	high

Detections

Analytics

CVE-2006-6383

medium

Tenable Plugins

critical

critical

high

high

medium

high