The resource system in PHP 5.0.0 through 5.2.1 allows context-dependent attackers to execute arbitrary code by interrupting the hash_update_file function via a userspace (1) error or (2) stream handler, which can then be used to destroy and modify internal resources. NOTE: it was later reported that PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 are also affected.

According to its banner, the version of PHP 5.3 installed on the remote host is older than 5.3.3.  Such versions may be affected by several security issues :

  - An error exists when processing invalid XML-RPC     requests that can lead to a NULL pointer     dereference. (bug #51288) (CVE-2010-0397)

  - An error exists in the function 'shm_put_var' that     is related to resource destruction.

  - An error exists in the function 'fnmatch' that can lead     to stack exhaustion. (CVE-2010-1917)

  - A memory corruption error exists related to call-time     pass by reference and callbacks.

  - The dechunking filter is vulnerable to buffer overflow.

  - An error exists in the sqlite extension that could     allow arbitrary memory access.

  - An error exists in the 'phar' extension related to     string format validation.

  - The functions 'mysqlnd_list_fields' and     'mysqlnd_change_user' are vulnerable to buffer overflow.

  - The Mysqlnd extension is vulnerable to buffer overflow     attack when handling error packets.

  - The following functions are not properly protected     against function interruptions :

    addcslashes, chunk_split, html_entity_decode,     iconv_mime_decode, iconv_substr, iconv_mime_encode,     htmlentities, htmlspecialchars, str_getcsv,     http_build_query, strpbrk, strtr, str_pad,     str_word_count, wordwrap, strtok, setcookie,     strip_tags, trim, ltrim, rtrim, substr_replace,     parse_str, pack, unpack, uasort, preg_match, strrchr     (CVE-2010-1860, CVE-2010-1862, CVE-2010-1864,     CVE-2010-2097, CVE-2010-2100, CVE-2010-2101,     CVE-2010-2190, CVE-2010-2191, CVE-2010-2484)

  - The following opcodes are not properly protected     against function interruptions :

    ZEND_CONCAT, ZEND_ASSIGN_CONCAT, ZEND_FETCH_RW, XOR     (CVE-2010-2191)

  - The default session serializer contains an error     that can be exploited when assigning session     variables having user defined names. Arbitrary     serialized values can be injected into sessions by     including the PS_UNDEF_MARKER, '!', character in     variable names.

  - A use-after-free error exists in the function     'spl_object_storage_attach'. (CVE-2010-2225)

  - An information disclosure vulnerability exists in the     function 'var_export' when handling certain error     conditions. (CVE-2010-2531)

According to its banner, the version of PHP 5.2 installed on the remote host is older than 5.2.14.  Such versions may be affected by several security issues :

  - An error exists when processing invalid XML-RPC     requests that can lead to a NULL pointer     dereference. (bug #51288) (CVE-2010-0397)

  - An error exists in the function 'fnmatch' that can lead     to stack exhaustion.

  - An error exists in the sqlite extension that could     allow arbitrary memory access.

  - A memory corruption error exists in the function     'substr_replace'.

  - The following functions are not properly protected     against function interruptions :

    addcslashes, chunk_split, html_entity_decode,     iconv_mime_decode, iconv_substr, iconv_mime_encode,     htmlentities, htmlspecialchars, str_getcsv,     http_build_query, strpbrk, strstr, str_pad,     str_word_count, wordwrap, strtok, setcookie,     strip_tags, trim, ltrim, rtrim, parse_str, pack, unpack,     uasort, preg_match, strrchr, strchr, substr, str_repeat     (CVE-2010-1860, CVE-2010-1862, CVE-2010-1864,     CVE-2010-2097, CVE-2010-2100, CVE-2010-2101,     CVE-2010-2190, CVE-2010-2191, CVE-2010-2484)

  - The following opcodes are not properly protected     against function interruptions :

    ZEND_CONCAT, ZEND_ASSIGN_CONCAT, ZEND_FETCH_RW     (CVE-2010-2191)

  - The default session serializer contains an error     that can be exploited when assigning session     variables having user defined names. Arbitrary     serialized values can be injected into sessions by     including the PS_UNDEF_MARKER, '!', character in     variable names.

  - A use-after-free error exists in the function     'spl_object_storage_attach'. (CVE-2010-2225)

  - An information disclosure vulnerability exists in the     function 'var_export' when handling certain error     conditions. (CVE-2010-2531)

The remote host is running a version of PHP lower than 4.4.7 or 5.2.2.  This version is vulnerable to a number of remote issues.  At least one of these issues is related to a buffer overflow attack.  An attacker exploiting these flaws would be able to impact confidentiality, integrity, and availability. 

ID	Name	Product	Family	Severity
48245	PHP 5.3 < 5.3.3 Multiple Vulnerabilities	Nessus	CGI abuses	high
48244	PHP 5.2 < 5.2.14 Multiple Vulnerabilities	Nessus	CGI abuses	high
3982	PHP 4.x < 4.4.7 / 5.x < 5.2.2 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	high

Detections

Analytics

CVE-2007-1581

critical

Tenable Plugins

high

high

high