Off-by-one error in the str_ireplace function in PHP 5.2.1 might allow context-dependent attackers to cause a denial of service (crash).

This update fixes security problems also fixed in PHP 5.2.1, including following problems :

  - Multiple buffer overflows in PHP before 5.2.1 allow     attackers to cause a denial of service and possibly     execute arbitrary code via unspecified vectors in the     (1) session, (2) zip, (3) imap, and (4) sqlite     extensions; (5) stream filters; and the (6) str_replace,     (7) mail, (8) ibase_delete_user, (9) ibase_add_user, and     (10) ibase_modify_user functions. (CVE-2007-0906)

  - Buffer underflow in PHP before 5.2.1 allows attackers to     cause a denial of service via unspecified vectors     involving the sapi_header_op function. (CVE-2007-0907)

  - The wddx extension in PHP before 5.2.1 allows remote     attackers to obtain sensitive information via     unspecified vectors. (CVE-2007-0908)

  - Multiple format string vulnerabilities in PHP before     5.2.1 might allow attackers to execute arbitrary code     via format string specifiers to (1) all of the *print     functions on 64-bit systems, and (2) the odbc_result_all     function. (CVE-2007-0909)

  - Unspecified vulnerability in PHP before 5.2.1 allows     attackers to 'clobber' certain super-global variables     via unspecified vectors. (CVE-2007-0910)

  - Off-by-one error in the str_ireplace function in PHP     5.2.1 might allow context-dependent attackers to cause a     denial of service (crash). (CVE-2007-0911)

  - PHP 5.2.0 and 4.4 allows local users to bypass safe_mode     and open_basedir restrictions via a malicious path and a     null byte before a ';' in a session_save_path argument,     followed by an allowed path, which causes a parsing     inconsistency in which PHP validates the allowed path     but sets session.save_path to the malicious path. And     another fix for open_basedir was added to stop mixing up     its setting in a virtual host environment.
    (CVE-2006-6383)

CVE-2007-0906: Multiple buffer overflows in PHP before 5.2.1 allow attackers to cause a denial of service and possibly execute arbitrary code via unspecified vectors in the (1) session, (2) zip, (3) imap, and (4) sqlite extensions; (5) stream filters; and the (6) str_replace, (7) mail, (8) ibase_delete_user, (9) ibase_add_user, and (10) ibase_modify_user functions.

CVE-2007-0907: Buffer underflow in PHP before 5.2.1 allows attackers to cause a denial of service via unspecified vectors involving the sapi_header_op function.

CVE-2007-0908: The wddx extension in PHP before 5.2.1 allows remote attackers to obtain sensitive information via unspecified vectors.

CVE-2007-0909: Multiple format string vulnerabilities in PHP before 5.2.1 might allow attackers to execute arbitrary code via format string specifiers to (1) all of the *print functions on 64-bit systems, and (2) the odbc_result_all function.

CVE-2007-0910: Unspecified vulnerability in PHP before 5.2.1 allows attackers to 'clobber' certain super-global variables via unspecified vectors.

CVE-2007-0911: Off-by-one error in the str_ireplace function in PHP 5.2.1 might allow context-dependent attackers to cause a denial of service (crash).

CVE-2006-6383: PHP 5.2.0 and 4.4 allows local users to bypass safe_mode and open_basedir restrictions via a malicious path and a null byte before a ';' in a session_save_path argument, followed by an allowed path, which causes a parsing inconsistency in which PHP validates the allowed path but sets session.save_path to the malicious path. And another fix for open_basedir was added to stop mixing up its setting in a virtual host environment.

The remote host is running a version of PHP lower than 4.4.7 or 5.2.2.  This version is vulnerable to a number of remote issues.  At least one of these issues is related to a buffer overflow attack.  An attacker exploiting these flaws would be able to impact confidentiality, integrity, and availability. 

According to its banner, the version of PHP installed on the remote host is older than 4.4.7 / 5.2.2.  Such versions may be affected by several issues, including buffer overflows in the GD library.

The remote host is affected by the vulnerability described in GLSA-200703-21 (PHP: Multiple vulnerabilities)

    Several vulnerabilities were found in PHP by the Hardened-PHP Project     and other researchers. These vulnerabilities include a heap-based     buffer overflow in htmlentities() and htmlspecialchars() if called with     UTF-8 parameters, and an off-by-one error in str_ireplace(). Other     vulnerabilities were also found in the PHP4 branch, including possible     overflows, stack corruptions and a format string vulnerability in the
    *print() functions on 64 bit systems.
  Impact :

    Remote attackers might be able to exploit these issues in PHP     applications making use of the affected functions, potentially     resulting in the execution of arbitrary code, Denial of Service,     execution of scripted contents in the context of the affected site,     security bypass or information leak.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
29377	SuSE 10 Security Update : PHP5 (ZYPP Patch Number 2684)	Nessus	SuSE Local Security Checks	critical
27390	openSUSE 10 Security Update : php5 (php5-2687)	Nessus	SuSE Local Security Checks	critical
3982	PHP 4.x < 4.4.7 / 5.x < 5.2.2 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	high
25159	PHP < 4.4.7 / 5.2.2 Multiple Vulnerabilities	Nessus	CGI abuses	high
24887	GLSA-200703-21 : PHP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical

Detections

Analytics

CVE-2007-0911

high

Tenable Plugins

critical

critical

high

high

critical